Memory Corruption Vulnerability in LE Audio Broadcast Sink by Zephyr Project

CVE-2026-19570

What is CVE-2026-19570?

The LE Audio Broadcast Sink in the Zephyr Project contains a vulnerability that allows an attacker within radio range to exploit the lack of bounds checking during the copying of subgroup metadata from a Basic Audio Announcement (BASE). The absence of checks leads to the possibility of memory corruption beyond allocated boundaries, which may allow for remote code execution within the Bluetooth RX thread. This issue can be triggered when a broadcast source with crafted BASE data is received, allowing an attacker to manipulate the device’s memory state without the need for pairing or bonding, thereby posing substantial risks to Bluetooth network integrity.

References