The bt_iso_recv() function in Zephyr OS's Bluetooth ISO receive code pulls ISO SDU headers from inbound HCI ISO Data buffers without verifying the buffer length first. Although the upstream handler enforces the buffer length, a malicious or buggy BLE controller or peer can send a PDU shorter than the expected header length. Because the length check is only enforced by assertions that are disabled in production, this leads to underflow of the buffer length and out-of-bounds reads of adjacent memory. In multi-fragment cases, this corrupted buffer is retained, and subsequent fragments cause an out-of-bounds write via memcpy, potentially corrupting memory. This vulnerability affects ISO receive builds configured with LE Audio options and has existed since the ISO subsystem introduction (v2.6.0) through v4.4.0. The patch adds explicit length checks to drop buffers that are too short before pulling data.

The vulnerability allows an attacker controlling a BLE controller or adjacent BLE peer on an established CIS/BIS connection to cause out-of-bounds memory reads and writes in the Bluetooth ISO receive path. This can lead to memory corruption and denial of service (crash or instability) of the affected device. There is no indication of privilege escalation or information disclosure beyond the described memory corruption. No known exploits in the wild have been reported.

A fix is available that adds explicit buffer length checks to prevent underflow and out-of-bounds memory access by dropping malformed buffers before processing. Users should apply the official patch or upgrade to a fixed version of Zephyr OS that includes this correction. Since this is not a cloud service, remediation depends on applying the patch to affected devices. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.