{"id":"CVE-2026-18748","kind":"vulnerability","aliases":["CVE-2026-18748"],"related":[],"title":"Zephyr Bluetooth A2DP: oversized codec IE leaks adjacent RAM to a paired peer","description":"The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp_process_config_ind() in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes but assigned the full, attacker-chosen length to len, and then persisted that inconsistent structure into the application's struct bt_a2dp_stream via stream->codec_config. bt_a2dp_get_config_cb() and bt_a2dp_set_config_cb() had the same truncate-the-copy-but-keep-the-length pattern.\n\nEvery later consumer trusts len. In particular the responder for an incoming AVDTP GET_CONFIGURATION, a2dp_get_config_ind(), executes net_buf_add_mem(rsp_buf, &ep->stream->codec_config.codec_ie[0], ep->stream->codec_config.len), so a paired BR/EDR peer that first sends a SET_CONFIGURATION carrying an oversized codec IE and then requests the configuration back causes the stack to read up to roughly 245 bytes past the end of the 8-byte array and transmit them in the response. codec_config is the last member of struct bt_a2dp_stream, so the read runs into memory adjacent to the application's stream object. The same inconsistency is also handed to the config_req(), reconfig_req() and get_config_rsp() application callbacks, where a natural memcpy() of len bytes performs a further out-of-bounds read.\n\nReaching the on-air disclosure requires CONFIG_BT_CLASSIC with CONFIG_BT_A2DP, an AVDTP peer that has completed pairing (the AVDTP L2CAP channel requires BT_SECURITY_L2), and a local endpoint registered for a non-SBC codec — BT_A2DP_MPEG1/BT_A2DP_MPEG2/BT_A2DP_ATRAC/BT_A2DP_VENDOR via BT_A2DP_EP_INIT() — because the SBC branch already pins the IE length to 4 bytes. The bt_a2dp_get_config_cb() response path has no such gate and hands the lying length to any application. There is no out-of-bounds write: the net_buf tailroom check bounds the destination, so the impact is limited to disclosure of a bounded region of adjacent RAM to the peer.\n\nThe fix replaces the hardcoded BT_A2DP_MAX_IE_LENGTH with the configurable CONFIG_BT_A2DP_CODEC_MAX_IE_LEN (default 8, range 4–253), sizes codec_ie[] from it, and rejects any received IE that exceeds it instead of silently truncating, so len can no longer exceed the number of valid bytes.","summary":"The Zephyr Bluetooth Classic A2DP host copies only 8 bytes of a codec Information Element but keeps the attacker-supplied length, so a later GET_CONFIGURATION response reads roughly 245 bytes of adjacent memory. A paired Bluetooth peer can receive that adjacent RAM over the air, a disclosure rather than code execution.","severity":"low","cvss":3.5,"epss":0.00158,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2dp","bluetooth","embedded","runtime","zephyr"],"not_affected_if":["no-a2dp","no-bluetooth-classic","sbc-only-codec"],"how_to_check":"- Check whether the firmware is built with `CONFIG_BT_CLASSIC=y` and `CONFIG_BT_A2DP=y`.\n- Check whether a local endpoint is registered for a non-SBC codec (BT_A2DP_MPEG1, BT_A2DP_MPEG2, BT_A2DP_ATRAC or BT_A2DP_VENDOR) via `BT_A2DP_EP_INIT()`.\n- Check the Zephyr version in the tree; the sources do not name the fixed version range.","fix":"- Zephyr: move to a release that includes the fix replacing `BT_A2DP_MAX_IE_LENGTH` with `CONFIG_BT_A2DP_CODEC_MAX_IE_LEN` and rejecting oversized IEs (fixed version: unknown).\n- Until patched, unknown; the sources do not offer a configuration workaround.","status":"open","published_at":"2026-10-21T19:17:02+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:45:41+00:00","updated_at":"2026-10-25T04:45:41+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:45:41Z","model":"claude-haiku-5-5","output":{"fix":"- Zephyr: move to a release that includes the fix replacing `BT_A2DP_MAX_IE_LENGTH` with `CONFIG_BT_A2DP_CODEC_MAX_IE_LEN` and rejecting oversized IEs (fixed version: unknown).\n- Until patched, unknown; the sources do not offer a configuration workaround.","reach":"network","title":"Zephyr Bluetooth A2DP: oversized codec IE leaks adjacent RAM to a paired peer","impact":"low","summary":"The Zephyr Bluetooth Classic A2DP host copies only 8 bytes of a codec Information Element but keeps the attacker-supplied length, so a later GET_CONFIGURATION response reads roughly 245 bytes of adjacent memory. A paired Bluetooth peer can receive that adjacent RAM over the air, a disclosure rather than code execution.","category":"runtime","nicknames":[],"who_cares":["zephyr","bluetooth","embedded","a2dp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Adjacent device RAM is disclosed to a paired Bluetooth peer","analyst_note":"Find the fixed Zephyr release version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-18748 and confirm the affected version range.","how_to_check":"- Check whether the firmware is built with `CONFIG_BT_CLASSIC=y` and `CONFIG_BT_A2DP=y`.\n- Check whether a local endpoint is registered for a non-SBC codec (BT_A2DP_MPEG1, BT_A2DP_MPEG2, BT_A2DP_ATRAC or BT_A2DP_VENDOR) via `BT_A2DP_EP_INIT()`.\n- Check the Zephyr version in the tree; the sources do not name the fixed version range.","needs_analyst":true,"not_affected_if":["no-bluetooth-classic","sbc-only-codec","no-a2dp"],"who_is_affected":"Devices running Zephyr with Bluetooth Classic and A2DP enabled, where a non-SBC codec endpoint is registered and a peer can pair. The SBC-only path is not exposed because it pins the IE length to 4 bytes. Devices without Bluetooth Classic or A2DP can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000854,"input_tokens":4252,"output_tokens":858,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-18748':16A,19A '-2026':15A,18A '0':214C '245':55B,248C '253':458C '4':379C,457C '8':33B,104C,119C,131C,255C,455C 'a2dp':3A,20B,29B,81C,92C,121C,155C,162C,168C,199C,273C,334C,362C,366C,383C,440C,449C 'add':206C 'adjac':8A,58B,67B,281C,429C 'air':71B,325C 'alreadi':373C 'also':292C 'applic':151C,284C,304C,400C 'array':108C,257C 'assign':134C 'attack':44B,138C 'attacker-chosen':137C 'attacker-suppli':43B 'avdtp':111C,196C,336C,343C 'back':239C 'bluetooth':2A,21B,27B,62B,79C 'bound':319C,407C,414C,426C 'br/edr':221C 'branch':372C 'bt':91C,154C,161C,167C,272C,329C,333C,347C,361C,365C,382C,439C,448C 'buf':205C,209C,411C 'byte':34B,56B,98C,105C,120C,132C,249C,256C,312C,380C,486C 'callback':305C 'carri':229C 'caus':240C 'cb':165C,171C,386C 'channel':345C 'check':413C 'chosen':139C 'classic':28B,80C,330C 'code':76B 'codec':5A,37B,85C,93C,106C,115C,159C,232C,264C,360C,450C,460C 'codec_config.codec':212C 'codec_config.len':217C 'complet':340C 'config':123C,160C,164C,170C,201C,265C,296C,302C,328C,332C,385C,447C 'configur':51B,198C,228C,238C,446C 'consum':186C 'copi':31B,127C,178C 'cve':14A,17A 'default':454C 'destin':416C 'disclosur':73B,326C,423C 'element':39B,87C 'embed':22B 'end':252C 'endpoint':353C 'ep':210C,215C,367C 'everi':184C 'exceed':470C,481C 'execut':77B,203C 'field':100C 'first':130C,224C 'fix':103C,435C 'full':136C 'gate':392C 'get':50B,163C,197C,200C,301C,384C 'hand':293C,394C 'hardcod':438C 'host':30B,82C 'ie':6A,88C,94C,107C,116C,213C,233C,376C,442C,452C,461C,468C 'impact':419C 'incom':195C 'inconsist':147C,290C 'ind':124C,202C 'inform':38B,86C 'init':368C 'instead':472C 'keep':41B,180C 'l2':349C 'l2cap':344C 'last':268C 'later':49B,185C 'leak':7A 'len':99C,142C,188C,311C,453C,477C 'length':46B,140C,182C,377C,397C,443C 'lie':396C 'limit':421C 'local':352C 'longer':117C,480C 'max':441C,451C 'mem':207C 'member':269C 'memcpi':309C 'memori':59B,280C 'mpeg1/bt_a2dp_mpeg2/bt_a2dp_atrac/bt_a2dp_vendor':363C 'natur':308C 'net':204C,410C 'non':358C 'non-sbc':357C 'number':483C 'object':287C 'on-air':323C 'one':97C 'one-byt':96C 'out-of-bound':316C,404C 'overs':4A,231C 'pair':12A,61B,220C,341C 'particular':190C 'past':250C 'path':388C 'pattern':183C 'peer':13A,63B,112C,222C,337C,433C 'perform':313C 'persist':145C 'pin':374C 'plus':101C 'process':122C 'ram':9A,68B,430C 'rang':456C 'rather':74B 'reach':321C 'read':53B,244C,277C,320C 'receiv':65B,467C 'reconfig':298C 'region':427C 'regist':354C 'reject':465C 'replac':436C 'req':297C,299C 'request':236C 'requir':327C,346C 'respond':192C 'respons':52B,263C,387C 'rough':54B,247C 'rsp':208C,303C 'run':278C 'runtim':23B 'sbc':359C,371C 'secur':348C 'send':225C 'sent':113C 'set':169C,227C 'silent':474C 'size':459C 'stack':242C 'store':83C 'stream':156C,158C,211C,216C,274C,286C 'struct':90C,153C,271C 'structur':148C 'subsys/bluetooth/host/classic/a2dp.c':126C 'suppli':45B 'tailroom':412C 'transmit':259C 'truncat':176C,475C 'truncate-the-copy-but-keep-the-length':175C 'trust':187C 'valid':485C 'via':157C,364C 'write':408C 'zephyr':1A,24B,26B","nicknames":[],"mitigations":[],"who_affected":"Devices running Zephyr with Bluetooth Classic and A2DP enabled, where a non-SBC codec endpoint is registered and a peer can pair. The SBC-only path is not exposed because it pins the IE length to 4 bytes. Devices without Bluetooth Classic or A2DP can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18748","severity":null,"published_at":"2026-10-21T19:17:02+00:00","modified_at":"2026-10-23T22:16:59+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-18748","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-18748","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}