An integer underflow in the function bt_mesh_sol_recv() within Zephyr's Bluetooth Mesh solicitation handling causes an out-of-bounds write. When the configuration option CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the function parses solicitation PDUs from raw BLE advertising payloads. The vulnerability arises because the code reads an attacker-controlled length byte (reported_len) and subtracts 3 without verifying that reported_len is at least 3. If reported_len is less than 3, the subtraction underflows in signed integer arithmetic, producing a negative value that bypasses length checks and is converted to a large size_t value. This leads to advancing a buffer pointer far beyond its bounds, causing invalid memory dereferences. An attacker can exploit this by sending a non-connectable BLE advertisement with a crafted UUID16 AD structure and length byte, potentially causing denial of service or arbitrary code execution without requiring pairing or prior association.

The vulnerability allows a nearby attacker to cause out-of-bounds memory writes by sending specially crafted BLE advertisements. This can lead to denial of service through system crashes or potentially arbitrary code execution, compromising device integrity. The attack requires only proximity and no prior pairing or authentication, increasing its risk in Bluetooth-enabled environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the CONFIG_BT_MESH_OD_PRIV_PROXY_SRV feature if feasible to mitigate exposure. Monitor vendor channels for updates and apply patches promptly once available.