Bluetooth Mesh Proxy Vulnerability in Zephyr RTOS

CVE-2026-15894

What is CVE-2026-15894?

The vulnerability in the Bluetooth Mesh On-Demand Private Proxy implementation of Zephyr RTOS allows for a stack-based buffer overflow. The affected handler does not properly enforce boundaries when copying data into a fixed-size buffer, making it susceptible to overflow if an attacker sends a manipulated Bluetooth advertisement. Specifically, during the solicitation process, excessive Service Data structures can be appended, exploiting the lack of proper length checks. The attack does not require prior authentication and can lead to unauthorized access, remote code execution, or a reliable denial of service.

References