PT-2026-47704 · Unknown · Zephyr Project

1Seal · CVE-2026-5068 · Published 2026-06-09 · Updated 2026-06-09

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zephyr Project (affected versions not specified)

Description A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. This occurs when the application enables segmentation via chan ops.alloc buf and the selected RX pool has a user data size smaller than 2 bytes. In this scenario, the segmentation counter stored in the net buf user data area is written out of bounds within the l2cap chan le recv seg() function. This can lead to heap corruption or fatal errors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-5068

GHSA-QRCQ-HXWJ-MQXM

Affected Products

Zephyr Project

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5068.json · Exploit
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-qrcq-hxwj-mqxm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5068 · Security Note
• https://osv.dev/vulnerability/CVE-2026-5068 · Vendor Advisory
• https://github.com/zephyrproject-rtos/zephyr · Note