CVE-2026-9263

The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment (sc=0) always carries a 3-byte time_offset, so its segment-header len must be at least PDU_ISO_SEG_TIMEOFFSET_SIZE (3). isoal_check_seg_header() accepted start segments with len < 3 as valid, and isoal_rx_framed_consume() then computed length = seg_hdr->len - 3 in a uint8_t, underflowing to 253-255 when len is 0-2. That oversized length is passed to isoal_rx_append_to_sdu(), whose copy is clamped only against the destination SDU buffer size, not the source PDU length, so up to ~255 bytes of controller memory beyond the received PDU are copied (via sink_sdu_write_hci()/net_buf_add_mem) into an HCI ISO data packet and delivered to the host. The PDU and its segment headers are entirely attacker-controlled and arrive over the air, reachable through both the CIS and BIS-sync HCI data paths (hci_driver.c) and the vendor data path (ull_iso.c), so a remote CIS peer or a broadcaster the device is synced to can trigger an out-of-bounds read causing information disclosure to the host and potential denial of service (faults or malformed oversized HCI ISO packets). The flaw affects all Zephyr releases since framed ISO reception was introduced in v3.0.0. The fix rejects sc=0 segments with len < 3 in isoal_check_seg_header() and adds a guard before the subtraction in isoal_rx_framed_consume().

• CWE-125

• https://github.com/zephyrproject-rtos/zephyr/commit/28080d80fc8aca30af1dfd1338bd4481b13c7395Patch
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2Exploit, Patch, Vendor Advisory
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2Exploit, Patch, Vendor Advisory

Published

Jun 30, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9256NGINX Plus and NGINX Open Source have a vulnerability in the…9.2
• CVE-2026-9258Improper validation of SSH host keys in Canon EOS Network Se…9.8
• CVE-2026-9259Improper validation of server certificates in Canon EOS Netw…9.8
• CVE-2026-9260Use of hard-coded cryptographic keys in Canon EOS Network Se…9.8
• CVE-2026-9261Use of weak SSH cryptographic algorithms in Canon EOS Networ…9.8
• CVE-2026-9262Use of a non-secure protocol as the default FTP configuratio…7.5
• CVE-2026-9264A cross-site scripting (XSS) vulnerability in SketchUp 2026'…9.3
• CVE-2026-9265Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits…9.1
• CVE-2026-9266A Missing Required Cryptographic Step vulnerability has been…7
• CVE-2026-9267Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f…6.9
• CVE-2026-9269The Secure Copy Content Protection and Content Locking WordP…3.5
• CVE-2026-9270DataDog::DogStatsd versions through 0.07 for Perl allow metr…9.1