The function bt_sdp_parse_attribute() in Zephyr's Bluetooth SDP implementation performs an insufficient length check on SDP record buffers, verifying only that the buffer length is at least 3 bytes before reading a fourth byte (the data-element descriptor) without proper bounds checking. This leads to a one-byte out-of-bounds read when the buffer is exactly three bytes long. The out-of-bounds byte is used internally as a length selector and is not exposed to attackers. Subsequent length checks reject malformed records, limiting impact to an edge-case denial of service or assert panic when assertions are enabled. The vulnerability is reachable from remote Bluetooth BR/EDR peers acting as SDP servers. It affects Zephyr versions 4.3.0 and 4.4.0 and was fixed by adding the size of the type byte to the length check.

The vulnerability can cause a one-byte out-of-bounds read in the Bluetooth SDP parser, which may lead to a denial of service via a fault or deterministic assert panic if assertions are enabled. There is no confidentiality or integrity impact as the out-of-bounds byte is not leaked or used maliciously beyond internal length selection. The attack vector requires a remote Bluetooth BR/EDR peer sending crafted SDP records. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue was fixed by adding the missing length check to include the size of the data-element descriptor byte. Until a patch is applied, consider disabling Bluetooth SDP client functionality or enabling CONFIG_ASSERT to detect the fault during testing. No other specific mitigations are indicated.