Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-9263

The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment (sc=0) always carries a 3-byte time_offset, so its segment-header len must be at least PDU_ISO_SEG_TIMEOFFSET_SIZE (3). isoal_check_seg_header() accepted start segments with len < 3 as valid, and isoal_rx_framed_consume() then computed length = seg_hdr->len - 3 in a uint8_t, underflow
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:e530a91796290175b6d608f49539811c5b523b933b978a6ef62f7cbae36daf96
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/bluetooth/controller/ll_sw/isoal.c"],"vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"3.3.0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:81515ba2f92cb2d247ff8decd020eb23a052c3b686f590057ded311d5c93c7c6 · sha256:bad3f4f72e3c6962… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:81515ba2f92cb2d247ff8decd020eb23a052c3b686f590057ded311d5c93c7c6 · sha256:bad3f4f72e3c6962… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-125","description":"bounds","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:81515ba2f92cb2d247ff8decd020eb23a052c3b686f590057ded311d5c93c7c6 · sha256:bad3f4f72e3c6962… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"Fix commit","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/28080d80fc8aca30af1dfd1338bd4481b13c7395"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:81515ba2f92cb2d247ff8decd020eb23a052c3b686f590057ded311d5c93c7c6 · sha256:bad3f4f72e3c6962… · /containers/cna/references/0
{"name":"GHSA-6gvp-pmh8-fjh2","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:81515ba2f92cb2d247ff8decd020eb23a052c3b686f590057ded311d5c93c7c6 · sha256:bad3f4f72e3c6962… · /containers/cna/references/1
{"tags":["exploit"],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:81515ba2f92cb2d247ff8decd020eb23a052c3b686f590057ded311d5c93c7c6 · sha256:bad3f4f72e3c6962… · /containers/adp/0/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer