CVE-2026-19570

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19570

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19570.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19570

Aliases

GHSA-4qwc-2qfq-w2fj

Published

2026-10-09T07:16:38Z

Modified

2026-10-11T07:04:32Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

Details

The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets.

The defect is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR, so the path is active in every broadcast-sink build once the device is periodic-advertising-synced. An attacker in radio range who operates a broadcast source the device syncs to — or who impersonates the advertiser address and SID of one already in use, periodic advertising data being unauthenticated — can change the BASE at will; each new BASE is re-parsed.

A crafted BASE therefore writes attacker-chosen bytes past the end of a fixed static object in .bss: up to roughly 236 bytes for an oversized metadata LTV, plus whole struct bt_bap_bass_subgroup records for each subgroup beyond CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. This is memory corruption of adjacent Bluetooth-audio state reachable with no pairing, bonding or GATT connection, with a potential for remote code execution in the Bluetooth RX thread; in addition, the unvalidated metadata_len is forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps it nor rejects it, leading to a further copy into the receive state and to out-of-bounds memory being disclosed in the BASS receive-state notification sent to a connected Broadcast Assistant.

The fix rejects a BASE carrying more subgroups than the receive state can hold (discarding the update entirely) and omits metadata that does not fit rather than copying it, and additionally honours the previously-ignored error return of the subgroup decode pass.

Database specific

{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-120",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19570.json"
}

References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type

GIT

Repo

https://github.com/zephyrproject-rtos/zephyr

Events

Introduced

468eb56cf242eedba62006ee758700ee6148763f

Fixed

5738f61f4128bb38508bab57342b1f7bf218d127

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "3.6.0"
        },
        {
            "last_affected": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*

v3.6.0

v3.7.0

v3.7.0-rc1

v3.7.0-rc2

v3.7.0-rc3

v4.*

v4.0.0

v4.0.0-rc1

v4.0.0-rc2

v4.0.0-rc3

v4.1.0

v4.1.0-rc1

v4.1.0-rc2

v4.1.0-rc3

v4.2.0

v4.2.0-rc1

v4.2.0-rc2

v4.2.0-rc3

v4.3.0

v4.3.0-rc1

v4.3.0-rc2

v4.3.0-rc3

v4.4.0

v4.4.0-rc1

v4.4.0-rc2

v4.4.0-rc3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19570.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "89639250881921461428321733328325395888",
                "294756770548867545286660971783345169428",
                "147919520720776713959891958060977182936",
                "330437784143584374398306990005076653296",
                "263866269550027057997884405701701323927",
                "100368840651485477544624688640897078925",
                "21317355058463673021804550469493341671",
                "171306193858979053124820849032683676944",
                "137480847642186527787577572414524410555",
                "286671510545799820835079133343842513345",
                "219449782079088604115569323615446021159",
                "300756553361722182553163320588104765441",
                "324872131229588656947315974873153677179",
                "326938214319867795020884080856408393148",
                "236210081762565214856143168632629490488",
                "70474732998465280343911549596222349156",
                "16702914253146064628034916642210124505",
                "334955931473348912214567269901933348520",
                "186764318817582402233506766846834521356",
                "63085645242609247277882672156219973317",
                "320142875104612695442819300828627545302",
                "217793329716293586420685933015832690571",
                "146344808921182675730013177248591260834",
                "248185320415441973979968873002301706409",
                "46989352758245658183091382236184540568",
                "257468955499649971584173209169582481804",
                "127145588533842498850749236385316758332",
                "25862518420509608550001969689439013657",
                "203076724754729896877732942242500579141",
                "47305627175546948212043768138541075764",
                "232411976727801904875176552218328318974",
                "190838669744768008172034326141061673154",
                "252250421692066261362275429512465793781",
                "91660480997662025190469972315819837787",
                "67202442240704222351163961096604165192"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-19570-33be8b0c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127",
        "target": {
            "file": "subsys/bluetooth/audio/bap_broadcast_sink.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "64071744143067070331746692490497919891",
            "length": 995
        },
        "id": "CVE-2026-19570-46b578a1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127",
        "target": {
            "file": "subsys/bluetooth/audio/bap_broadcast_sink.c",
            "function": "update_recv_state_base"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "284122061243721422781664067113559513744",
            "length": 1246
        },
        "id": "CVE-2026-19570-a769d02f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127",
        "target": {
            "file": "subsys/bluetooth/audio/bap_broadcast_sink.c",
            "function": "pa_decode_base"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "107322468742867694739652278569837039801",
            "length": 411
        },
        "id": "CVE-2026-19570-be34dd00",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127",
        "target": {
            "file": "subsys/bluetooth/audio/bap_broadcast_sink.c",
            "function": "base_subgroup_meta_cb"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "322917616491296625524941897903834597006",
            "length": 1037
        },
        "id": "CVE-2026-19570-d88db7ef",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127",
        "target": {
            "file": "subsys/bluetooth/audio/bap_broadcast_sink.c",
            "function": "base_decode_subgroup_cb"
        }
    }
]

vanir_signatures_modified

"2026-10-11T07:04:32Z"