CVE-2026-18748

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-18748

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18748.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-18748

Aliases

GHSA-6qq5-25mp-x5rg

Published

2026-10-21T18:19:29Z

Modified

2026-10-22T07:26:23Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

Details

The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp_process_config_ind() in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes but assigned the full, attacker-chosen length to len, and then persisted that inconsistent structure into the application's struct bt_a2dp_stream via stream->codec_config. bt_a2dp_get_config_cb() and bt_a2dp_set_config_cb() had the same truncate-the-copy-but-keep-the-length pattern.

Every later consumer trusts len. In particular the responder for an incoming AVDTP GET_CONFIGURATION, a2dp_get_config_ind(), executes net_buf_add_mem(rsp_buf, &ep->stream->codec_config.codec_ie[0], ep->stream->codec_config.len), so a paired BR/EDR peer that first sends a SET_CONFIGURATION carrying an oversized codec IE and then requests the configuration back causes the stack to read up to roughly 245 bytes past the end of the 8-byte array and transmit them in the response. codec_config is the last member of struct bt_a2dp_stream, so the read runs into memory adjacent to the application's stream object. The same inconsistency is also handed to the config_req(), reconfig_req() and get_config_rsp() application callbacks, where a natural memcpy() of len bytes performs a further out-of-bounds read.

Reaching the on-air disclosure requires CONFIG_BT_CLASSIC with CONFIG_BT_A2DP, an AVDTP peer that has completed pairing (the AVDTP L2CAP channel requires BT_SECURITY_L2), and a local endpoint registered for a non-SBC codec — BT_A2DP_MPEG1/BT_A2DP_MPEG2/BT_A2DP_ATRAC/BT_A2DP_VENDOR via BT_A2DP_EP_INIT() — because the SBC branch already pins the IE length to 4 bytes. The bt_a2dp_get_config_cb() response path has no such gate and hands the lying length to any application. There is no out-of-bounds write: the net_buf tailroom check bounds the destination, so the impact is limited to disclosure of a bounded region of adjacent RAM to the peer.

The fix replaces the hardcoded BT_A2DP_MAX_IE_LENGTH with the configurable CONFIG_BT_A2DP_CODEC_MAX_IE_LEN (default 8, range 4–253), sizes codec_ie[] from it, and rejects any received IE that exceeds it instead of silently truncating, so len can no longer exceed the number of valid bytes.

Database specific

{
    "cna_assigner":  "zephyr",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18748.json"
}

References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type

GIT

Repo

https://github.com/zephyrproject-rtos/zephyr

Events

Introduced

3568e1b6d5cdd51a6b964a2a1d6d29200fea2056

Last Affected

dccb09599635bdff17633fa7e9dab014b91dce90

Fixed

c5f649f4714e625362fbaa93ffd7419f9c27342b

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.3.0"
                },
                {
                    "last_affected":  "4.4.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "c5f649f4714e625362fbaa93ffd7419f9c27342b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v4.*

v4.3.0

v4.4.0

v4.4.0-rc1

v4.4.0-rc2

v4.4.0-rc3

v4.4.1

v4.4.1-rc1

v4.4.2

v4.4.2-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18748.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "87407497791837019938873558990256730305",
            "length":  730
        },
        "id":  "CVE-2026-18748-1a0d3a1a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "subsys/bluetooth/host/classic/a2dp.c",
            "function":  "bt_a2dp_stream_config_set_param"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "251858120939401031253399303295772424026",
            "length":  917
        },
        "id":  "CVE-2026-18748-42a4bc40",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "subsys/bluetooth/host/classic/a2dp.c",
            "function":  "bt_a2dp_set_config_cb"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "220678699082149653779564746458687029022",
            "length":  679
        },
        "id":  "CVE-2026-18748-48f37136",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "subsys/bluetooth/host/classic/a2dp.c",
            "function":  "bt_a2dp_stream_reconfig"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "315750874642157258908764089539116243205",
                "295437334817636245536108105379826141827",
                "323006997778431745983966106561447675401",
                "74335997703668601599167297338756561916",
                "102391262494144234775584777433465993374",
                "325080182428995550429213689099572652238",
                "219686147730634377348875623562576513185",
                "152167662905474630239241523636055925501",
                "247911575884224932740552126980877111213",
                "109737139386765966999010658015758588407",
                "118788491841874478708900331187097485421",
                "309689398287972442880885911382405847209",
                "44664580401000686266948531333791733793",
                "45549655288646506649613474970321220991",
                "11050927864294038804974405770553054863",
                "324913485557161905411252305261077407231",
                "90784456051375423408208820339332496878",
                "197847307089829910106689545428656849660",
                "100698663799923159663666016148139708971",
                "46515746175890116678061096441556753310",
                "57740446099397135944872382486899233518",
                "301376730780956439818002351286650485886",
                "251747985091792202612423876508084284421",
                "233292373506280462151963481186261461087",
                "297741141682296565266064478751852773452",
                "290905397491811632270744273057341557938",
                "17976209018534851740187327748161586731",
                "167874666620836706043293130392618135366",
                "132489806046994308984444815828959272001",
                "153941775410180503917944124641193903547",
                "302624562056812244677389439584087768760",
                "101477178519085186699076374536043435108",
                "110670935243481368615134668684245165215",
                "13812052642305918245851293876514527388",
                "205878631339865009558161121435348817277",
                "37051233185177627409609030757847135953",
                "300790291563189719085584218205322569230",
                "28107063654660939597586512896299303736",
                "161464449026108714456545268167433705949",
                "321743091867209395413780459692849488334",
                "117565417289981502269496986154478929926",
                "19719489339128625147891927279367408071",
                "152930348117392847099378294624271265195",
                "174869182677007269620260037631659787296",
                "136732623164173974462740092596343263010",
                "339427913226632351119450676061090887259",
                "50144596379553729930853163786895383324",
                "329803739641411855096743441966705355446",
                "309114697107075920828665249511169170986",
                "267868390585593816517915983992887850017",
                "109789575659412514693059533498223388041",
                "28440622809845629422611806668356889240",
                "212211897836344782203704256934308472634",
                "122497356599630472233239145867207972873",
                "61880177349985417810154157560868683960",
                "143449542484999295894518718479580182552",
                "233662887196971127157040335689415868190",
                "181543273252830995193154897733249601149",
                "239728238631719311967129447083580856179",
                "206043713942727775637678504589003515941",
                "48218301809640419875701725830900435660",
                "283256482044775623830667909325516362807",
                "6291614159548182537161930990493990972",
                "8298384745944457677399949120898579346",
                "192926709752910177357971438041500342378",
                "74335997703668601599167297338756561916",
                "102391262494144234775584777433465993374",
                "325080182428995550429213689099572652238",
                "179987382981783601389892580988901961502",
                "222041742780573646409989695289576641277",
                "4224486312105014076591209900812231719",
                "105108279492462277319628685537828667086",
                "164691109189463071713097226636097770400",
                "137950783998460674006835831412983951959",
                "149037439263021382107381964334388923362"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-18748-5cc25f75",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "subsys/bluetooth/host/classic/a2dp.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "329261428119773976962961292531859262537",
            "length":  1176
        },
        "id":  "CVE-2026-18748-928264c1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "subsys/bluetooth/host/classic/a2dp.c",
            "function":  "bt_a2dp_stream_config"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "85347422737144647277866803898861399210",
            "length":  1010
        },
        "id":  "CVE-2026-18748-934d2f41",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "subsys/bluetooth/host/classic/a2dp.c",
            "function":  "bt_a2dp_get_config_cb"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "140674588605193527718897024581031386037",
            "length":  2053
        },
        "id":  "CVE-2026-18748-9683b0fa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "subsys/bluetooth/host/classic/a2dp.c",
            "function":  "a2dp_process_config_ind"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "224861269593236494486863542204613522516",
            "length":  1537
        },
        "id":  "CVE-2026-18748-a4b27af6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "subsys/bluetooth/host/classic/a2dp.c",
            "function":  "bt_a2dp_get_capabilities_cb"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "286453912675025196355352590566251185316",
                "271419047730790638914577317343261531531",
                "13897902785678072014820323739121711485",
                "280323171310482767342971033648467592400",
                "13819168669319062741861946175523449037",
                "212450964863221899568734953826615564582",
                "206999016860970813862767915572892516663"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-18748-fbd50513",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b",
        "target":  {
            "file":  "include/zephyr/bluetooth/classic/a2dp.h"
        }
    }
]

vanir_signatures_modified

"2026-10-22T07:26:23Z"