Integer Underflow in Bluetooth Mesh Solicitation Handling Affects Zephyr Project

CVE-2026-5589

What is CVE-2026-5589?

The Zephyr Project's Bluetooth Mesh implementation contains an integer underflow vulnerability in the solicitation handling function, bt_mesh_sol_recv(). This issue arises when handling raw Bluetooth Low Energy (BLE) advertising payloads, specifically due to improper validation of the length byte. When the CONFIG_BT_MESH_OD_PRIV_PROXY_SRV configuration is enabled, an attacker can exploit this flaw by crafting a non-connectable advertisement with a manipulated length byte. If the reported length is less than 3, the arithmetic operation can result in a negative value, leading to significant security risks such as out-of-bounds writes, which may cause denial of service or even arbitrary code execution. This vulnerability requires no prior pairing or association, making it a potential target for attackers.

References