Threat database

An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.

‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to‬ ‭a crash and a resultant denial of service.‬

There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into the link.rx.buf receiver buffer without any validation on the data size.

System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escalation for malicious userspace processes.

Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.

CVE-2025-10456 is a high-severity integer overflow or wraparound vulnerability in the Zephyr RTOS Bluetooth Low Energy (BLE) stack. It arises from improper handling of BLE fixed channels such as SMP or ATT, where disconnection attempts on these fixed channels can cause undefined behavior including assertion failures, crashes, or memory corruption. This affects Zephyr versions prior to 3.7.2 and versions from 4.0.0 up to but not including 4.3.0.

CVE-2025-10458 is a high severity vulnerability in Zephyr RTOS involving improper handling of length parameters due to lack of validation or sanitization. This flaw affects versions prior to 4.3.0 and can impact system confidentiality, integrity, and availability. No exploit is currently known in the wild and no patch information is provided.

CVE-2025-7403 is a high-severity vulnerability in Zephyr RTOS versions prior to 4.2.0. It involves unsafe handling in the bt_conn_tx_processor component, causing a use-after-free condition that leads to a write-before-zero. This flaw allows an attacker to control 4 bytes of memory written, enabling precise memory corruption.

CVE-2025-10457 is a medium severity vulnerability in Zephyr RTOS versions prior to 4.3.0. The issue arises because the BLE connection response handler does not verify if a response is expected and relies solely on identifier matching. This improper security check can lead to incorrect handling of BLE connection responses, potentially causing denial of service.

CVE-2025-2962 is a denial-of-service vulnerability in the Zephyr RTOS DNS implementation caused by an infinite loop with an unreachable exit condition. This flaw can cause the affected system to become unresponsive due to resource exhaustion. It has a high severity score of 8.2 and impacts availability only, without affecting confidentiality or integrity.

CVE-2025-1675 is a high severity vulnerability in the Zephyr RTOS affecting versions before 3.7.2 and from 4.0.0 up to but not including 4.1.0. It is caused by an out-of-bounds read in the dns_copy_qname function due to memcpy being called on an untrusted source without verifying the source buffer size. This flaw can lead to denial of service through memory corruption. No known exploits have been reported in the wild. Patch status is not confirmed due to lack of vendor advisory information.

CVE-2025-1674 is a high-severity vulnerability in the Zephyr real-time operating system caused by insufficient input validation that leads to out-of-bounds reads. This flaw can be triggered by malicious or malformed packets and may cause denial of service through application crashes. It affects Zephyr versions prior to 3.7.2 and versions from 4.0.0 up to but not including 4.1.0. No known exploits have been reported in the wild. The CVSS score of 8.2 reflects a significant risk mainly due to potential availability impact.

CVE-2025-1673 is an out-of-bounds read vulnerability in the DNS handling code of the Zephyr RTOS. It can be triggered by a malicious or malformed DNS packet without a payload, potentially causing a crash or incorrect computation. This leads to denial of service conditions. The vulnerability affects Zephyr versions prior to 3.7.2 and versions from 4.0.0 up to but not including 4.1.0. The severity is high with a CVSS score of 8.2.