CVE-2026-5068

A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.

• CWE-787

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qrcq-hxwj-mqxmExploit, Patch, Vendor Advisory

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50674Use after free in Windows USB Print Driver allows an authori…7.8
• CVE-2026-50675Heap-based buffer overflow in Microsoft Office Excel allows …7.8
• CVE-2026-50676Concurrent execution using shared resource with improper syn…7
• CVE-2026-50677Use after free in Windows Media allows an authorized attacke…7.8
• CVE-2026-50678Heap-based buffer overflow in Microsoft Office Excel allows …3.3
• CVE-2026-50679Heap-based buffer overflow in Microsoft Windows Search Compo…7.8
• CVE-2026-50680Heap-based buffer overflow in Windows Hyper-V allows an auth…7.8
• CVE-2026-50681Exposure of sensitive information to an unauthorized actor i…5.5
• CVE-2026-50682Out-of-bounds read in Windows Active Directory allows an aut…7.1
• CVE-2026-50683Heap-based buffer overflow in Windows DHCP Server allows an …8
• CVE-2026-50684Improper neutralization of input during web page generation …4.8
• CVE-2026-50685Double free in Windows DHCP Server allows an authorized atta…7.5