Zephyr Bluetooth LE Audio Basic Audio Profile Vulnerability in Unicast Client

CVE-2026-10593

What is CVE-2026-10593?

A vulnerability exists within the Zephyr Bluetooth LE Audio Basic Audio Profile unicast client, specifically in how it processes peer-supplied ASE state notifications. The flaw arises when attacker-controlled QoS fields are mishandled, leading to potential denial of service. If a remote ASCS server sends a GATT notification signaling an inappropriate state transition, it could trigger a crash through a NULL pointer dereference. This affects devices utilizing versions 4.3.0 and 4.4.0 of the Zephyr framework. To mitigate this risk, corrective measures have adjusted the storage of BAP QoS data to maintain integrity and prevent unexpected resource access failures.

References