CVE-2026-10660
- Source
- https://cve.org/CVERecord?id=CVE-2026-10660
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10660.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-10660
- Aliases
-
- GHSA-73c7-3rh7-v5p9
- Published
- 2026-07-11T17:00:13.644Z
- Modified
- 2026-07-22T03:45:05.322560Z
- Severity
-
- 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
- Summary
- Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption
- Details
-
The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bapbroadcastassistant.c reassembled remote Broadcast Receive State data into a single file-static netbufsimple (attbuf, BTATTMAXATTRIBUTE_LEN = 512 bytes) shared by all connection instances, while the BUSY flag, long-read handle, and reset/offset state were per-connection.
When the device acts as a Broadcast Assistant connected to multiple Scan Delegator peripherals, notification and long-read callbacks from different connections interleave on the shared buffer: the append in notifyhandler (netbufsimpleaddmem at the not-busy branch) performs no tailroom check, so receive-state notifications from two or more delegators accumulate on the same 512-byte buffer and, with a sufficiently large configured ATT MTU (BTL2CAPTXMTU up to 2000) and two-to-three concurrent connections, write past the buffer into adjacent .bss (netbufsimple_add only asserts in debug builds).
Even below the overflow threshold, one connection's netbufsimple_reset zeroes the shared length while another connection's reassembly and GATT read offset are in flight, mixing one peer's data into another's parse. A malicious or compromised Scan Delegator (or two colluding peers) over BLE can trigger this, causing out-of-bounds writes (memory corruption / denial of service) and cross-connection data corruption.
The fix moves the buffer into the per-connection instance struct so each connection reassembles into its own buffer. Affects Zephyr releases shipping the Broadcast Assistant with the shared buffer, including v4.4.0 and earlier.
- Database specific
{ "cwe_ids": [ "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10660.json", "cna_assigner": "zephyr", "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "introduced": "3.6.0" }, { "fixed": "4.5.0" } ] } ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10660.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-73c7-3rh7-v5p9
- https://nvd.nist.gov/vuln/detail/CVE-2026-10660
- https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected versions
v1.*
v1.0.0
v1.1.0
v1.1.0-rc1
v1.10.0
v1.10.0-rc1
v1.10.0-rc2
v1.10.0-rc3
v1.11.0
v1.11.0-rc1
v1.11.0-rc2
v1.11.0-rc3
v1.12.0
v1.12.0-rc1
v1.12.0-rc2
v1.12.0-rc3
v1.13.0
v1.13.0-rc1
v1.13.0-rc2
v1.13.0-rc3
v1.14.0
v1.14.0-rc1
v1.14.0-rc2
v1.14.0-rc3
v1.2.0
v1.2.0-rc1
v1.2.0-rc2
v1.3.0
v1.3.0-rc1
v1.3.0-rc2
v1.4.0
v1.4.0-rc1
v1.4.0-rc2
v1.4.0-rc3
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.5.0-rc4
v1.6.99
v1.7.99
v1.8.99
v1.9.0
v1.9.0-rc1
v1.9.0-rc2
v1.9.0-rc3
v1.9.0-rc4
v2.*
v2.0.0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.1.0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.2.0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.3.0
v2.3.0-rc1
v2.3.0-rc2
v2.4.0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.5.0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.5.0-rc4
v2.6.0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.7.99
v3.*
v3.0.0
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.1.0
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.2.0
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.0-rc3
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.4.0-rc3
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.5.0-rc3
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3
zephyr-v1.*
zephyr-v1.0.0
zephyr-v1.1.0
zephyr-v1.10.0
zephyr-v1.11.0
zephyr-v1.12.0
zephyr-v1.13.0
zephyr-v1.14.0
zephyr-v1.2.0
zephyr-v1.3.0
zephyr-v1.4.0
zephyr-v1.5.0
zephyr-v1.9.0
zephyr-v2.*
zephyr-v2.0.0
zephyr-v2.1.0
zephyr-v2.2.0
zephyr-v2.3.0
zephyr-v2.4.0
zephyr-v2.5.0
zephyr-v2.6.0
zephyr-v3.*
zephyr-v3.0.0
zephyr-v3.1.0
zephyr-v3.2.0
zephyr-v3.3.0
zephyr-v3.4.0
zephyr-v3.5.0
Database specific
vanir_signatures_modified
"2026-07-22T03:45:05Z"
vanir_signatures
[
{
"signature_type": "Line",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-359b4152",
"signature_version": "v1",
"digest": {
"line_hashes": [
"198158273556425829178182036869213802285",
"85290949569585164828366368622321942356",
"74776520109125187697508816437149640118",
"262690131748055050191012160222088826134",
"128933768558563957548017551813493943174",
"165618253691610187478868901725250712161",
"63183777211839762432040869511642754750",
"117704815985105090155694418537937693550",
"7265289940213195447768875630008515339",
"33390677157632819206632769691904322738",
"168653555099333714424729162629151512631",
"149719962797554107810532019332341442423",
"337437330224178429923505423210343587893",
"253725152341259466184088221661732390839",
"57890761011158538932996795065166613142",
"206783961087250143942521004622168850697",
"305256727307647414435913960974640848476",
"99714645917596895663225497669203327923",
"209403418095797597157460663453440989269",
"38322628842486510623506305702900186664",
"249420565213323932139769570714489357157",
"317646934766995560279690704192140674313",
"201826008754230770014598310406425983255",
"38257475363893706106965951334095807838",
"168176979630530764515919012336634985138",
"155287484730472484776671283112968898922",
"174053455022562609379328521505118853951",
"197443563551555845401887180958576974034",
"147390948529649553863873105958568356173",
"332216340517626994983169677695944953842",
"110678274032214733823240677963194796594",
"299789557886628284820880395688895345902",
"309358068476523790743995115921991434429",
"248638863236181089806078295391411012985",
"328308904759442305848369287377581613",
"324415501514635442398805538099472572455",
"141580261487287699799506285730414181561",
"323928611341812781880555563287323286529",
"273740604530718751518786025789166216926",
"67380067707057470977963127833899092055",
"278562236687760102965341126931895112889",
"80768485113735690156411917771258126260",
"213819291470965115682149151781200475829",
"293140080027419884911872762807544546229",
"10169846017179882875289942933786639288",
"295468208562421944182296255078398580889",
"153883527595937537494592153654958160860",
"238839047092991545756471531165385833599",
"135783565650179227966897864566582836858",
"227898972866479259330739187239442229908",
"301838404837594140274915348695608010279",
"214019362573842320775990686910637998091",
"284761036555895442511547533851552389213",
"115727128878168711677559048279153653047",
"285881206232067933810478387126701775616",
"283175800545178431639460197743258381582",
"89329801846023034689319897934333126968",
"87168758676423223933700566173149266555",
"139719281915223471650486195643894959145",
"316830034594498995157967701718432573085",
"218876171995604273002529163994648080910",
"63952582445743647275339659814682832670",
"184665986388261955039743281380704099109",
"259856508903595156650149052071202715937",
"214008935928716793628188696779577758489",
"38037082159250994129968453519718013962",
"107551051365377810144479904362260732851",
"195200821838530757591243595958074870224",
"292745083146267103862256896081363241307",
"271335802973656718438140148386712174157",
"169406636978620799765093139452020965729",
"36250384115216084745659419119032538702",
"17746123546074437854563536873848618583",
"143319537935104020828402286490454256103",
"4563849628284349290116414860169958879",
"308653263855625173692783596858234021071",
"254172278723097103842100239288287051621",
"122517876050224277286075228800090885752",
"334654843107329885864553511038158661371",
"290230174969179239684795223930353997320",
"244679880781040971073177109798455162625",
"247055749019173014347272218212238406870",
"183715868992481149353617228577960476203",
"183410371477830240163378005970382590132",
"87792693087522804412678065460257992064",
"195200821838530757591243595958074870224",
"292745083146267103862256896081363241307",
"103818915791768413376166237598009200627",
"84613342697263386354629427493751474383",
"30361791685450435091744041401153874868",
"17746123546074437854563536873848618583",
"143319537935104020828402286490454256103",
"4563849628284349290116414860169958879",
"308653263855625173692783596858234021071",
"254172278723097103842100239288287051621",
"122517876050224277286075228800090885752",
"334654843107329885864553511038158661371",
"290230174969179239684795223930353997320",
"244679880781040971073177109798455162625",
"247055749019173014347272218212238406870",
"183715868992481149353617228577960476203",
"164384565715786058498592870998406000182",
"324675798540599195352479508868606612868",
"195200821838530757591243595958074870224",
"292745083146267103862256896081363241307",
"120418508812673844141429191237965049352",
"289413698747155325509466012678502996786",
"218260642016309060145899319692435546177",
"18160932374468868273401408075328695476",
"47342605982818618710953740755088421179",
"116084528593043366245627576039830129496",
"42274351024236961072831527305762971809",
"195200821838530757591243595958074870224",
"292745083146267103862256896081363241307",
"21173231007114940714391681838284773214",
"149148298545294127497942039199655530594",
"16710623383127128802433146749979520666",
"81589764919428229345706543320214151454",
"78508227997715375055422781777718458349",
"289384708714096554537573502907903767833"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bt_bap_broadcast_assistant_scan_stop"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-43bf7670",
"signature_version": "v1",
"digest": {
"function_hash": "70860801150921563977460879371660104430",
"length": 827.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "discover_init"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-45cc0893",
"signature_version": "v1",
"digest": {
"function_hash": "249463943458208292743745397191062794523",
"length": 200.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "notify_handler"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-465a5c99",
"signature_version": "v1",
"digest": {
"function_hash": "133781233171415755470808036576245611692",
"length": 1203.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "long_bap_read"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-71e1118e",
"signature_version": "v1",
"digest": {
"function_hash": "2359625126777543740552945186749989455",
"length": 960.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "broadcast_assistant_bap_ntf_read_func"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-76bd4cd0",
"signature_version": "v1",
"digest": {
"function_hash": "11000646151836975767429865194585728083",
"length": 1021.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bt_bap_broadcast_assistant_add_src"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-7e0ebc8f",
"signature_version": "v1",
"digest": {
"function_hash": "334306988708067923263242614836252200285",
"length": 2329.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bt_bap_broadcast_assistant_scan_start"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-919623b8",
"signature_version": "v1",
"digest": {
"function_hash": "89045452542408049978489747446700410078",
"length": 1370.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bap_broadcast_assistant_discover_complete"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-9a7dc4d4",
"signature_version": "v1",
"digest": {
"function_hash": "218282006482024331523804751073159305339",
"length": 445.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bap_broadcast_assistant_write_cp_cb"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-bb6915f3",
"signature_version": "v1",
"digest": {
"function_hash": "307507479856030782495263655852802590519",
"length": 1140.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bt_bap_broadcast_assistant_mod_src"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-be3ca1ee",
"signature_version": "v1",
"digest": {
"function_hash": "88548004813246770608483726708187934887",
"length": 2245.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bt_bap_broadcast_assistant_set_broadcast_code"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-cfdf3b4a",
"signature_version": "v1",
"digest": {
"function_hash": "35318389569630825405405646618494706667",
"length": 800.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bap_long_read_reset"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-d8fe2ff8",
"signature_version": "v1",
"digest": {
"function_hash": "299214304305120660362323864262414419968",
"length": 149.0
}
},
{
"signature_type": "Function",
"target": {
"file": "subsys/bluetooth/audio/bap_broadcast_assistant.c",
"function": "bt_bap_broadcast_assistant_rem_src"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/0cd61589ff820b6a585c73cb36f1e14b043a2795",
"id": "CVE-2026-10660-fb491569",
"signature_version": "v1",
"digest": {
"function_hash": "243247886127970953097774443590757799873",
"length": 590.0
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10660.json"