CVE-2026-18748: bounds in zephyrproject zephyr

The Bluetooth Classic A2DP host in Zephyr stores codec Information Elements (IE) in a structure with a fixed 8-byte array but a length field that can be set larger than 8. When an AVDTP peer sends a codec IE longer than 8 bytes, the code copies only the first 8 bytes but assigns the full length to the length field, which is then trusted by later consumers. This leads to out-of-bounds reads of up to approximately 245 bytes past the array when responding to GET_CONFIGURATION requests or in application callbacks. The vulnerability requires CONFIG_BT_CLASSIC with CONFIG_BT_A2DP, pairing with an AVDTP peer, and use of non-SBC codecs. The fix replaces the fixed maximum IE length with a configurable maximum and rejects oversized IEs instead of truncating them, preventing the length mismatch and out-of-bounds reads.

An attacker controlling a paired AVDTP peer can cause the Zephyr Bluetooth stack to disclose adjacent memory contents beyond the intended codec IE buffer by sending an oversized codec IE and then requesting the configuration. This leads to limited information disclosure of adjacent RAM to the attacker. There is no out-of-bounds write or code execution impact.

A fix is available that replaces the fixed maximum IE length with a configurable maximum and rejects any received codec IE that exceeds this limit, preventing the length mismatch and out-of-bounds reads. Users should upgrade to a fixed version beyond 4.4.2 or apply the official patch when available. Until patched, avoid pairing with untrusted AVDTP peers using non-SBC codecs.