The Bluetooth BAP Broadcast Assistant GATT client in Zephyr uses a single static 512-byte buffer shared by all connection instances to reassemble remote Broadcast Receive State data. Notification and long-read callbacks from multiple concurrent connections interleave on this shared buffer without adequate tailroom checks, allowing data to overflow the buffer when the ATT MTU is large and multiple connections are active. Additionally, concurrent operations can cause one connection's reset to zero the buffer length while another is still reading, resulting in cross-connection data mixing. This leads to out-of-bounds memory writes causing memory corruption, denial of service, and data corruption across connections. The vulnerability can be triggered by a malicious or compromised Scan Delegator over BLE. The fix involves moving the buffer to be per-connection rather than shared. Affected versions include Zephyr v3.6.0 and earlier that include the vulnerable Broadcast Assistant implementation.

Exploitation can cause out-of-bounds memory writes leading to memory corruption and denial of service. Additionally, data from one BLE connection can be corrupted or mixed with another, potentially affecting the integrity of Bluetooth Broadcast Assistant operations. The vulnerability requires multiple concurrent BLE connections and a sufficiently large ATT MTU to trigger the overflow. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix moves the shared buffer into per-connection instances to prevent cross-connection interference and buffer overflow. Until an official fix is available, avoid configurations with multiple concurrent Scan Delegator connections and large ATT MTU settings where possible.