The Bluetooth BAP Broadcast Assistant GATT client in Zephyr uses a single static 512-byte buffer shared across all connection instances to reassemble remote Broadcast Receive State data. When connected to multiple Scan Delegator peripherals, concurrent notification and long-read callbacks interleave on this shared buffer without tailroom checks, allowing accumulation of data beyond the buffer size. With a large ATT MTU (up to 2000) and multiple concurrent connections, this results in out-of-bounds writes into adjacent memory. Additionally, concurrent operations can cause one connection's reset to zero the buffer length while another is reading, mixing data between peers. This vulnerability enables memory corruption, denial of service, and cross-connection data corruption. The issue affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, specifically versions =3.6.0 and >=3.6.0 <4.5.0. The fix moves the buffer into the per-connection instance struct to isolate buffers per connection.

Exploitation can lead to out-of-bounds memory writes causing memory corruption and denial of service. Cross-connection data corruption is also possible, potentially mixing data between different BLE peers. The vulnerability requires a malicious or compromised Scan Delegator or colluding peers to trigger the condition over BLE. The CVSS 3.1 score is 6.4, indicating medium severity with local attack vector (adjacent network), high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves moving the shared buffer to a per-connection instance buffer to prevent concurrent access issues. Until an official fix is available, avoid deploying the Broadcast Assistant feature in multi-connection scenarios or restrict connections to trusted devices to reduce risk.