CVE-2026-10641: bounds in zephyrproject zephyr
Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Service Level Connection setup the HF sends AT+CIND=? and parses the AG's +CIND: response in cind_handle(), which assigns a per-entry counter index and calls cind_handle_values() for each list element. cind_handle_values() then wrote hf->ind_table[index] = i without verifying that index is within the 20-element int8_t ind_table[] array of struct bt_hfp_hf. Because the parser places no cap on the number of +CIND: list entries, a remote Attendant Gateway (a malicious, compromised, or spoofed peer the device connects to over Bluetooth) can send a response with more than 20 recognized indicator entries and drive index arbitrarily large, writing a small attacker-positioned value past the array into adjacent struct fields (feature masks, SDP/version state, the calls[] array, work/atomic bookkeeping) and potentially beyond the static connection pool slot. This yields memory corruption and at least denial of service of the Bluetooth host, triggered by a single malformed AT response with no user interaction. The sibling consumer ag_indicator_handle_values() already performed the equivalent bounds check; this commit adds the same index >= ARRAY_SIZE(hf->ind_table) guard to close the gap. Affects builds with CONFIG_BT_HFP_HF enabled; introduced with the original HFP HF CIND parser (~v1.7) and present through v4.4.0.
AI Analysis
Technical Summary
The vulnerability in Zephyr's Bluetooth Classic HFP Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) involves an out-of-bounds write to the ind_table array during parsing of the AG's +CIND: response. The parser assigns an index to each indicator entry without verifying it is within the 20-element array bounds, allowing a remote Attendant Gateway to send more than 20 entries and cause memory corruption. This can lead to denial of service of the Bluetooth host. The sibling parser function already included bounds checking, and the fix adds the same guard to prevent out-of-bounds writes. The vulnerability affects versions starting from 1.7.0 through 4.4.0 with CONFIG_BT_HFP_HF enabled.
Potential Impact
A remote Bluetooth Attendant Gateway can trigger an out-of-bounds write by sending a malformed +CIND: response with more than 20 indicator entries. This memory corruption can overwrite adjacent structure fields and potentially beyond the static connection pool slot, resulting in denial of service of the Bluetooth host. No confidentiality or availability impacts beyond denial of service are described. No user interaction is required to trigger the vulnerability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by adding bounds checking on the index before writing to the ind_table array. Until an official patch is available, disabling CONFIG_BT_HFP_HF or avoiding connections to untrusted Bluetooth Attendant Gateways may reduce risk.
CVE-2026-10641: bounds in zephyrproject zephyr
Description
Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Service Level Connection setup the HF sends AT+CIND=? and parses the AG's +CIND: response in cind_handle(), which assigns a per-entry counter index and calls cind_handle_values() for each list element. cind_handle_values() then wrote hf->ind_table[index] = i without verifying that index is within the 20-element int8_t ind_table[] array of struct bt_hfp_hf. Because the parser places no cap on the number of +CIND: list entries, a remote Attendant Gateway (a malicious, compromised, or spoofed peer the device connects to over Bluetooth) can send a response with more than 20 recognized indicator entries and drive index arbitrarily large, writing a small attacker-positioned value past the array into adjacent struct fields (feature masks, SDP/version state, the calls[] array, work/atomic bookkeeping) and potentially beyond the static connection pool slot. This yields memory corruption and at least denial of service of the Bluetooth host, triggered by a single malformed AT response with no user interaction. The sibling consumer ag_indicator_handle_values() already performed the equivalent bounds check; this commit adds the same index >= ARRAY_SIZE(hf->ind_table) guard to close the gap. Affects builds with CONFIG_BT_HFP_HF enabled; introduced with the original HFP HF CIND parser (~v1.7) and present through v4.4.0.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Zephyr's Bluetooth Classic HFP Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) involves an out-of-bounds write to the ind_table array during parsing of the AG's +CIND: response. The parser assigns an index to each indicator entry without verifying it is within the 20-element array bounds, allowing a remote Attendant Gateway to send more than 20 entries and cause memory corruption. This can lead to denial of service of the Bluetooth host. The sibling parser function already included bounds checking, and the fix adds the same guard to prevent out-of-bounds writes. The vulnerability affects versions starting from 1.7.0 through 4.4.0 with CONFIG_BT_HFP_HF enabled.
Potential Impact
A remote Bluetooth Attendant Gateway can trigger an out-of-bounds write by sending a malformed +CIND: response with more than 20 indicator entries. This memory corruption can overwrite adjacent structure fields and potentially beyond the static connection pool slot, resulting in denial of service of the Bluetooth host. No confidentiality or availability impacts beyond denial of service are described. No user interaction is required to trigger the vulnerability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed by adding bounds checking on the index before writing to the ind_table array. Until an official patch is available, disabling CONFIG_BT_HFP_HF or avoiding connections to untrusted Bluetooth Attendant Gateways may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:11:41.956Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a32a8960b89be6888635835
Added to database: 06/17/2026, 14:00:54 UTC
Last enriched: 07/15/2026, 10:45:59 UTC
Last updated: 08/01/2026, 12:21:01 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.