Bluetooth GATT Client Vulnerability in Zephyr RTOS

CVE-2026-85034

What is CVE-2026-85034?

A buffer overflow vulnerability exists within the Bluetooth host's GATT client of Zephyr RTOS. This flaw allows a remote malicious GATT server, within radio range, to send a notification or indication exceeding the maximum attribute length of 512 octets. The vulnerability arises because the Bluetooth host validates only the minimum PDU length and fails to enforce the negotiated ATT MTU. As a result, when an overflow occurs, it overwrites adjacent memory structures, potentially allowing an attacker to manipulate program execution. The issue can be exploited if the configuration supports larger ATT MTU sizes. The introduced fix addresses this problem by rejecting any notification or indication values longer than the specified maximum before invoking subscriber callbacks.

References