Bluetooth Classic A2DP Host Vulnerability in Zephyr Project

CVE-2026-18748

What is CVE-2026-18748?

The Bluetooth Classic A2DP host vulnerability in the Zephyr Project allows for memory disclosure due to a flaw in the handling of codec Information Elements (IE) during configuration. When an attacker sends a codec IE longer than the expected length, the system mistakenly trusts the provided length, leading to the potential reading of adjacent memory areas. This happens when a paired AVDTP peer requests configuration data after sending an oversized codec IE. The issue can expose sensitive data located in the memory adjacent to the application's stream object. The fix involves ensuring codec lengths are validated and preventing the acceptance of oversized codec IEs to maintain data integrity and security.

References