{"id":"CVE-2026-77685","kind":"vulnerability","aliases":["CVE-2026-77685"],"related":[],"title":"Zephyr Bluetooth: RFCOMM echo handler lets unpaired devices read adjacent memory","description":"The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RFCOMM_TEST command as buf->len - 1 and passed it to rfcomm_send_test(), whose length parameter is a uint8_t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf->len == 0 after rfcomm_handle_msg() pulls the two-byte MCC header, so buf->len - 1 underflows and narrows to 255.\n\nrfcomm_send_test() then copies 255 bytes out of a receive buffer that holds no remaining valid data, and appends them to an outgoing L2CAP PDU allocated with only CONFIG_BT_L2CAP_TX_MTU (253 by default for CONFIG_BT_CLASSIC) bytes of tailroom. The source read runs past the end of the ACL receive buffer into adjacent buffers of the same net_buf pool, and the destination copy overruns the transmit buffer by about eight bytes; net_buf_add_mem() performs no runtime bounds check in ordinary builds, where the underlying __ASSERT_NO_MSG() is compiled out.\n\nThe trigger is a single five-byte RFCOMM frame on the multiplexer control channel, which is processed as soon as the L2CAP channel for PSM 3 is established — before any DLC exists and independent of RFCOMM session state. bt_rfcomm_init() registers that L2CAP server with .sec_level = BT_SECURITY_L1, which l2cap_br_conn_security() accepts without any link key from a peer that does not claim host Secure Simple Pairing support, so an unpaired BR/EDR device in radio range of a connectable target with CONFIG_BT_RFCOMM enabled (SPP, HFP, HSP, GOEP and similar profiles all enable it) can reach the defect.\n\nThe resulting 255-byte TEST response is transmitted back to the attacker, disclosing roughly 255 bytes of adjacent stack/pool memory — including the contents of neighbouring receive buffers, which an attacker can prime with earlier packets — and the accompanying out-of-bounds write corrupts memory following the transmit buffer, which can crash the Bluetooth host. The request is trivially repeatable, so both the disclosure and the corruption can be driven at will.\n\nTwo fixes are needed, and the first on its own does not close the out-of-bounds write. Fix 1 (0040ef781e1d, #115768) strips the FCS byte in rfcomm_recv() and echoes buf->len, rejecting anything over UINT8_MAX, which removes the underflow and the over-read. But rfcomm_make_uih_msg() still allocates the response with bt_l2cap_create_pdu() and never compares the requested length with the buffer's tailroom, so a well-formed TEST command carrying a pattern of about 248 bytes or more still builds a response (3-byte frame header, 2-byte message header, pattern, FCS) larger than the 253 bytes available. A pattern that long can only be received when the RFCOMM L2CAP receive MTU (CONFIG_BT_RFCOMM_L2CAP_MTU, which defaults to CONFIG_BT_BUF_ACL_RX_SIZE) exceeds CONFIG_BT_L2CAP_TX_MTU. The plain BR/EDR defaults (200 against 253) cannot reach it, but from v4.3.0 enabling CONFIG_BT_GOEP raises CONFIG_BT_BUF_ACL_RX_SIZE to 264 (265 from v4.4.0), so GOEP builds with only fix 1 applied still overrun the transmit buffer by up to eight bytes. This includes v4.3.2, the last v4.3 release, which carries fix 1 but will not receive fix 2. Fix 2 (214530895dd3, #118293) checks the tailroom on every RFCOMM PDU allocation and closes this residual write.","summary":"Zephyr's RFCOMM handler computes an echo length that underflows on a malformed control frame, so the device copies 255 bytes of adjacent memory into its reply and overruns the transmit buffer. An unpaired Bluetooth device in radio range can send that single frame and read stack or pool memory back, and can crash the Bluetooth host.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth-classic","embedded","iot","rfcomm","runtime","zephyr"],"not_affected_if":["ble-only","no-bt-classic","rfcomm-disabled"],"how_to_check":"- Check whether the build enables `CONFIG_BT_RFCOMM` (SPP, HFP, HSP and GOEP profiles do).\n- Check the Zephyr version with `west list zephyr` or the `VERSION` file; affected versions include v4.3.x GOEP builds with `CONFIG_BT_GOEP` set.\n- Check whether `CONFIG_BT_GOEP` is enabled, which raises `CONFIG_BT_BUF_ACL_RX_SIZE` to 264.","fix":"- Zephyr v4.3.2 and earlier v4.3 releases carry only the first fix and are not fully patched for GOEP builds; apply the second fix (commit 214530895dd3, PR #118293).\n- Fix 1 is commit 0040ef781e1d (PR #115768); fix 2 is required for GOEP builds and is the only change that closes the residual write.","status":"open","published_at":"2026-11-10T22:20:53+00:00","first_seen_at":"2026-11-10T22:27:30+00:00","triaged_at":"2026-11-10T22:29:01+00:00","updated_at":"2026-11-10T22:29:01+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-10T22:29:01Z","model":"claude-haiku-5-5","output":{"fix":"- Zephyr v4.3.2 and earlier v4.3 releases carry only the first fix and are not fully patched for GOEP builds; apply the second fix (commit 214530895dd3, PR #118293).\n- Fix 1 is commit 0040ef781e1d (PR #115768); fix 2 is required for GOEP builds and is the only change that closes the residual write.","reach":"network","title":"Zephyr Bluetooth: RFCOMM echo handler lets unpaired devices read adjacent memory","impact":"high","summary":"Zephyr's RFCOMM handler computes an echo length that underflows on a malformed control frame, so the device copies 255 bytes of adjacent memory into its reply and overruns the transmit buffer. An unpaired Bluetooth device in radio range can send that single frame and read stack or pool memory back, and can crash the Bluetooth host.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zephyr","bluetooth-classic","rfcomm","embedded","iot"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads 255 bytes of device memory and crashes the Bluetooth host","analyst_note":"Confirm the exact affected version ranges from the NVD and Zephyr advisory pages, since the sources give only the two fix commits and no explicit range.","how_to_check":"- Check whether the build enables `CONFIG_BT_RFCOMM` (SPP, HFP, HSP and GOEP profiles do).\n- Check the Zephyr version with `west list zephyr` or the `VERSION` file; affected versions include v4.3.x GOEP builds with `CONFIG_BT_GOEP` set.\n- Check whether `CONFIG_BT_GOEP` is enabled, which raises `CONFIG_BT_BUF_ACL_RX_SIZE` to 264.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-bt-classic","rfcomm-disabled","ble-only"],"who_is_affected":"Devices running Zephyr with Bluetooth Classic and RFCOMM enabled are exposed to a single unauthenticated radio frame. GOEP builds from v4.3.0 onward are exposed even after the first fix, because their receive buffer is large enough to reach the residual overrun. Builds without RFCOMM, or without a Classic Bluetooth stack, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001026,"input_tokens":5856,"output_tokens":880,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-77685':14A,17A '0':130C,135C '0040ef781e1d':452C '1':105C,150C,451C,609C,631C '115768':453C '118293':641C '2':528C,637C,639C '200':578C '214530895dd3':640C '248':516C '253':190C,537C,580C '255':45B,155C,161C,361C,373C '264':599C '265':600C '3':280C,524C 'accept':311C 'accompani':396C 'acl':209C,565C,595C 'add':235C 'adjac':10A,48B,213C,376C 'alloc':182C,485C,649C 'anyth':466C 'append':175C 'appli':610C 'assert':248C 'attack':370C,388C 'avail':539C 'back':76B,367C 'bluetooth':2A,19B,60B,81B,412C 'bluetooth-class':18B 'bound':240C,400C,448C 'br':308C 'br/edr':331C,576C 'bt':98C,186C,195C,293C,303C,342C,489C,555C,563C,570C,589C,593C 'buf':103C,133C,148C,219C,234C,463C,564C,594C 'buffer':57B,167C,211C,214C,228C,385C,407C,501C,615C 'build':244C,521C,605C 'byte':46B,144C,162C,197C,232C,261C,362C,374C,457C,517C,525C,529C,538C,620C 'cannot':581C 'carri':511C,629C 'channel':88C,268C,277C 'check':241C,642C 'claim':322C 'classic':20B,196C 'close':443C,651C 'command':101C,510C 'compar':495C 'compil':252C 'comput':30B,92C 'config':185C,194C,341C,554C,562C,569C,588C,592C 'conn':309C 'connect':338C 'content':381C 'control':39B,87C,267C 'control-channel':86C 'copi':44B,160C,224C 'corrupt':402C,425C 'crash':79B,410C 'creat':491C 'cve':12A,15A 'data':173C 'default':192C,560C,577C 'defect':358C 'destin':223C 'devic':8A,43B,61B,332C 'disclos':371C 'disclosur':422C 'dlc':285C 'dlci':129C 'driven':428C 'earlier':392C 'echo':4A,32B,94C,462C 'eight':231C,619C 'embed':21B 'enabl':344C,353C,587C 'end':206C 'establish':282C 'everi':646C 'exceed':568C 'exist':286C 'fcs':124C,456C,533C 'fcs-valid':123C 'first':437C 'five':260C 'five-byt':259C 'fix':432C,450C,608C,630C,636C,638C 'follow':404C 'form':508C 'frame':40B,69B,127C,263C,526C 'goep':348C,590C,604C 'handl':138C 'handler':5A,29B,89C 'header':146C,527C,531C 'hfp':346C 'hold':169C 'host':82B,323C,413C 'hsp':347C 'includ':379C,622C 'independ':288C 'init':295C 'iot':22B 'key':315C 'l1':305C 'l2cap':180C,187C,276C,298C,307C,490C,551C,557C,571C 'larger':534C 'last':625C 'leav':132C 'len':104C,134C,149C,464C 'length':33B,95C,114C,498C 'let':6A 'level':302C 'link':314C 'long':543C 'make':481C 'malform':38B,121C 'max':469C 'mcc':145C 'mem':236C 'memori':11A,49B,75B,378C,403C 'messag':530C 'msg':139C,250C,483C 'mtu':189C,553C,558C,573C 'multiplex':85C,266C 'narrow':153C 'need':434C 'neighbour':383C 'net':218C,233C 'never':494C 'ordinari':243C 'out-of-bound':397C,445C 'outgo':179C 'over-read':476C 'overrun':54B,225C,612C 'packet':393C 'pair':326C 'paramet':115C 'pass':107C 'past':204C 'pattern':513C,532C,541C 'pdu':181C,492C,648C 'peer':318C 'perform':237C 'plain':575C 'pool':74B,220C 'prime':390C 'process':271C 'profil':351C 'psm':279C 'pull':140C 'radio':63B,334C 'rais':591C 'rang':64B,335C 'reach':356C,582C 'read':9A,71B,202C,478C 'receiv':166C,210C,384C,547C,552C,635C 'recv':460C 'regist':296C 'reject':465C 'releas':627C 'remain':171C 'remov':471C 'repeat':418C 'repli':52B 'request':415C,497C 'residu':653C 'respons':364C,487C,523C 'result':360C 'rfcomm':3A,23B,28B,84C,99C,110C,137C,156C,262C,290C,294C,343C,459C,480C,550C,556C,647C 'rough':372C 'run':203C 'runtim':24B,239C 'rx':566C,596C 'sec':301C 'secur':304C,310C,324C 'send':66B,111C,157C 'server':299C 'session':291C 'similar':350C 'simpl':325C 'singl':68B,258C 'size':567C,597C 'soon':273C 'sourc':201C 'spp':345C 'stack':72B 'stack/pool':377C 'state':292C 'still':484C,520C,611C 'strip':454C 'subsys/bluetooth/host/classic/rfcomm.c':91C 'support':327C 'tailroom':199C,503C,644C 'target':339C 'test':100C,112C,158C,363C,509C 'transmit':56B,227C,366C,406C,614C 'trigger':255C 'trivial':417C 'two':143C,431C 'two-byt':142C 'tx':188C,572C 'uih':126C,482C 'uint8':118C,468C 'under':247C 'underflow':35B,151C,473C 'unpair':7A,59B,330C 'v4.3':626C 'v4.3.0':586C 'v4.3.2':623C 'v4.4.0':602C 'valid':125C,172C 'well':507C 'well-form':506C 'whose':113C 'without':312C 'write':401C,449C,654C 'zephyr':1A,25B,26B","nicknames":[],"mitigations":[],"who_affected":"Devices running Zephyr with Bluetooth Classic and RFCOMM enabled are exposed to a single unauthenticated radio frame. GOEP builds from v4.3.0 onward are exposed even after the first fix, because their receive buffer is large enough to reach the residual overrun. Builds without RFCOMM, or without a Classic Bluetooth stack, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bluetoothclassic","embedded","high","iot","rfcomm","runtime","zephyr"],"campaign_type":null,"search_a":"'-2026':13A,16A '-77685':14A,17A 'adjac':10A 'bluetooth':2A 'cve':12A,15A 'devic':8A 'echo':4A 'handler':5A 'let':6A 'memori':11A 'read':9A 'rfcomm':3A 'unpair':7A 'zephyr':1A","search_b":"'255':45B 'adjac':48B 'back':76B 'bluetooth':19B,60B,81B 'bluetooth-class':18B 'buffer':57B 'byte':46B 'classic':20B 'comput':30B 'control':39B 'copi':44B 'crash':79B 'devic':43B,61B 'echo':32B 'embed':21B 'frame':40B,69B 'handler':29B 'host':82B 'iot':22B 'length':33B 'malform':38B 'memori':49B,75B 'overrun':54B 'pool':74B 'radio':63B 'rang':64B 'read':71B 'repli':52B 'rfcomm':23B,28B 'runtim':24B 'send':66B 'singl':68B 'stack':72B 'transmit':56B 'underflow':35B 'unpair':59B 'zephyr':25B,26B","search_c":"'0':130C,135C '0040ef781e1d':452C '1':105C,150C,451C,609C,631C '115768':453C '118293':641C '2':528C,637C,639C '200':578C '214530895dd3':640C '248':516C '253':190C,537C,580C '255':155C,161C,361C,373C '264':599C '265':600C '3':280C,524C 'accept':311C 'accompani':396C 'acl':209C,565C,595C 'add':235C 'adjac':213C,376C 'alloc':182C,485C,649C 'anyth':466C 'append':175C 'appli':610C 'assert':248C 'attack':370C,388C 'avail':539C 'back':367C 'bluetooth':412C 'bound':240C,400C,448C 'br':308C 'br/edr':331C,576C 'bt':98C,186C,195C,293C,303C,342C,489C,555C,563C,570C,589C,593C 'buf':103C,133C,148C,219C,234C,463C,564C,594C 'buffer':167C,211C,214C,228C,385C,407C,501C,615C 'build':244C,521C,605C 'byte':144C,162C,197C,232C,261C,362C,374C,457C,517C,525C,529C,538C,620C 'cannot':581C 'carri':511C,629C 'channel':88C,268C,277C 'check':241C,642C 'claim':322C 'classic':196C 'close':443C,651C 'command':101C,510C 'compar':495C 'compil':252C 'comput':92C 'config':185C,194C,341C,554C,562C,569C,588C,592C 'conn':309C 'connect':338C 'content':381C 'control':87C,267C 'control-channel':86C 'copi':160C,224C 'corrupt':402C,425C 'crash':410C 'creat':491C 'data':173C 'default':192C,560C,577C 'defect':358C 'destin':223C 'devic':332C 'disclos':371C 'disclosur':422C 'dlc':285C 'dlci':129C 'driven':428C 'earlier':392C 'echo':94C,462C 'eight':231C,619C 'enabl':344C,353C,587C 'end':206C 'establish':282C 'everi':646C 'exceed':568C 'exist':286C 'fcs':124C,456C,533C 'fcs-valid':123C 'first':437C 'five':260C 'five-byt':259C 'fix':432C,450C,608C,630C,636C,638C 'follow':404C 'form':508C 'frame':127C,263C,526C 'goep':348C,590C,604C 'handl':138C 'handler':89C 'header':146C,527C,531C 'hfp':346C 'hold':169C 'host':323C,413C 'hsp':347C 'includ':379C,622C 'independ':288C 'init':295C 'key':315C 'l1':305C 'l2cap':180C,187C,276C,298C,307C,490C,551C,557C,571C 'larger':534C 'last':625C 'leav':132C 'len':104C,134C,149C,464C 'length':95C,114C,498C 'level':302C 'link':314C 'long':543C 'make':481C 'malform':121C 'max':469C 'mcc':145C 'mem':236C 'memori':378C,403C 'messag':530C 'msg':139C,250C,483C 'mtu':189C,553C,558C,573C 'multiplex':85C,266C 'narrow':153C 'need':434C 'neighbour':383C 'net':218C,233C 'never':494C 'ordinari':243C 'out-of-bound':397C,445C 'outgo':179C 'over-read':476C 'overrun':225C,612C 'packet':393C 'pair':326C 'paramet':115C 'pass':107C 'past':204C 'pattern':513C,532C,541C 'pdu':181C,492C,648C 'peer':318C 'perform':237C 'plain':575C 'pool':220C 'prime':390C 'process':271C 'profil':351C 'psm':279C 'pull':140C 'radio':334C 'rais':591C 'rang':335C 'reach':356C,582C 'read':202C,478C 'receiv':166C,210C,384C,547C,552C,635C 'recv':460C 'regist':296C 'reject':465C 'releas':627C 'remain':171C 'remov':471C 'repeat':418C 'request':415C,497C 'residu':653C 'respons':364C,487C,523C 'result':360C 'rfcomm':84C,99C,110C,137C,156C,262C,290C,294C,343C,459C,480C,550C,556C,647C 'rough':372C 'run':203C 'runtim':239C 'rx':566C,596C 'sec':301C 'secur':304C,310C,324C 'send':111C,157C 'server':299C 'session':291C 'similar':350C 'simpl':325C 'singl':258C 'size':567C,597C 'soon':273C 'sourc':201C 'spp':345C 'stack/pool':377C 'state':292C 'still':484C,520C,611C 'strip':454C 'subsys/bluetooth/host/classic/rfcomm.c':91C 'support':327C 'tailroom':199C,503C,644C 'target':339C 'test':100C,112C,158C,363C,509C 'transmit':227C,366C,406C,614C 'trigger':255C 'trivial':417C 'two':143C,431C 'two-byt':142C 'tx':188C,572C 'uih':126C,482C 'uint8':118C,468C 'under':247C 'underflow':151C,473C 'unpair':330C 'v4.3':626C 'v4.3.0':586C 'v4.3.2':623C 'v4.4.0':602C 'valid':125C,172C 'well':507C 'well-form':506C 'whose':113C 'without':312C 'write':401C,449C,654C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:46:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77685","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77685","severity":null,"published_at":"2026-11-10T22:20:53+00:00","modified_at":"2026-11-10T22:20:53+00:00","first_seen_at":"2026-11-10T22:27:30+00:00","fetched_at":"2026-11-10T22:27:30+00:00","note":null}],"documents":[{"id":119537,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":119538,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":119539,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mhhp-8w67-cggv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T21:46:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}