Remote Code Execution Vulnerability in Zephyr Bluetooth Host
CVE-2026-5068

7.6HIGH

Key Information:

Vendor

Zephyrproject-rtos

Status
Zephyr
Vendor
CVE Published:
9 June 2026

What is CVE-2026-5068?

A remote, unauthenticated Bluetooth Low Energy (BLE) peer can exploit a vulnerability in the Zephyr Bluetooth host that allows for a 2-byte out-of-bounds write during L2CAP LE connection-oriented channel (CoC) service data unit (SDU) reassembly. If segmentation is enabled and the RX pool's user_data_size is smaller than 2 bytes, an out-of-bounds write occurs within the net_buf user_data area, which leads to heap corruption and potential fatal errors. This vulnerability can impact the stability and security of systems utilizing the Zephyr Bluetooth framework.

Affected Version(s)

Zephyr 1.14.0 <= 4.3.0

References

https://github.com/zephyrproject-rtos/zephyr/security/adv...

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.