Remote Code Execution in AVRCP Target for Zephyr RTOS - Zephyr Project

CVE-2026-85033

What is CVE-2026-85033?

A vulnerability exists in the AVRCP Target role of Zephyr RTOS that allows a remote AVRCP Controller to trigger persistent loss of function. When a command results in a fragmented response, if the controller drops the link, the subsequent connections may find stale response buffers. This leads to a disruption in the sender's ability to process vendor-dependent responses, resulting in an ongoing transmission state that only a reboot can reset. The fix involves canceling pending responses and resetting the transmission state machine to prevent future occurrences and memory leaks.

References