The vulnerability exists in the function bt_mesh_sol_recv() within Zephyr's Bluetooth Mesh solicitation subsystem. When the CONFIG_BT_MESH_OD_PRIV_PROXY_SRV configuration is enabled, the function parses solicitation PDUs from raw BLE advertising payloads. The AD parsing loop reads an attacker-controlled length byte (reported_len) and subtracts 3 without verifying that reported_len is at least 3. If reported_len is less than 3, the subtraction underflows as a signed integer, resulting in a large size_t value when passed to net_buf_simple_pull_mem(). This causes the buffer pointer to advance far out of bounds, leading to subsequent invalid memory reads. An attacker can exploit this by sending a non-connectable BLE advertisement with a crafted UUID16 AD structure and length byte, potentially causing denial of service or arbitrary code execution.

A nearby attacker can trigger this vulnerability without any pairing or prior association by sending a specially crafted BLE advertisement. The out-of-bounds write and subsequent invalid memory dereference can cause denial of service or enable arbitrary code execution within the affected Zephyr RTOS Bluetooth Mesh component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the CONFIG_BT_MESH_OD_PRIV_PROXY_SRV feature if feasible to mitigate exposure. Monitor vendor channels for updates and apply patches promptly once released.