Out-of-Bounds Write in Zephyr's Bluetooth Classic HFP Parser

CVE-2026-10641

What is CVE-2026-10641?

The Bluetooth Classic Hands-Free Profile (HFP) parser in Zephyr RTOS is vulnerable to an out-of-bounds write during the Service Level Connection setup. In particular, the problem arises when the Hands-Free device sends a command that causes the parser to process an excessive number of entries, thus exceeding the bounds of the allocated array. This vulnerability allows a malicious remote Bluetooth device to exploit the system by sending a malformed AT response, leading to memory corruption, potentially affecting adjacent structures, and causing denial of service without requiring user interaction. Mitigation steps involve implementing bounds checks to ensure the index remains within the permissible limit.

References