Bluetooth RFComm Connectivity Flaw in Zephyr Project by Zephyr

CVE-2026-77685

What is CVE-2026-77685?

A vulnerability exists in the Bluetooth RFComm multiplexer control-channel handler within the Zephyr Project. This flaw occurs when a malformed UIH frame allows an underflow condition, permitting an attacker to read data beyond the intended buffer limits. Specifically, this vulnerability enables disclosure of adjacent memory contents and can lead to memory corruption, crashing the Bluetooth host. The issue can be exploited with a simple five-byte RFCOMM frame sent to an unpaired BR/EDR device, making it repeatable and significantly impacting the data security of devices using the affected software version. Two critical patches have been proposed to address both the underflow and the resulting overflow conditions.

References