Denial of Service Vulnerability in Bluetooth Host GATT Client by Zephyr Project

CVE-2026-12236

What is CVE-2026-12236?

A flaw exists in the GATT client functionality of the Bluetooth host within the Zephyr RTOS, specifically in the parse_read_std_char_desc function. This issue arises during the discovery of standard characteristic descriptions and can be triggered by an unauthenticated neighboring device, allowing attackers to potentially exploit the absence of validation for the response length. As a result, a rogue device can send a response with a zero length, causing the processing thread to enter an infinite loop, ultimately leading to a denial of service condition. The long-term impact affects system stability, potentially leading to reboots, but does not involve memory corruption or data leakage. The issue has been addressed by implementing checks to ensure that response lengths are validated before processing.

References