The function bt_sdp_parse_attribute() in Zephyr's Bluetooth SDP implementation incorrectly validates the length of SDP record buffers, allowing a one-byte read past the end of the buffer when the record is exactly three bytes long. This happens because the code checks for a minimum length of three bytes but then reads a fourth byte (the data-element descriptor) without proper bounds checking. The read is bounded and used internally, never exposed to attackers, and malformed records are subsequently rejected. The vulnerability can be triggered remotely via Bluetooth SDP discovery responses. It affects Zephyr versions 4.3.0 and 4.4.0 and was fixed by adding the size of the type byte to the length check.

The vulnerability results in a single-byte out-of-bounds read which can cause a denial of service either by a fault if the read crosses a mapped-memory boundary or by a deterministic assert panic when assertions are enabled. There is no confidentiality or integrity impact as the out-of-bounds byte is not leaked or used in a way that affects data integrity. The attack vector is remote over Bluetooth BR/EDR. Realistic impact is limited to an edge-case denial of service.

A fix is available that corrects the length check by including the size of the data-element descriptor byte. Users should apply the official patch or upgrade to a fixed version of Zephyr. Since this is a code-level fix, updating to the patched versions is the recommended mitigation.