Orangeyyc

**Name of the Vulnerable Software and Affected Versions** Zephyr (affected versions not specified) **Description** A missing length validation in the Bluetooth Host ISO receive path can be triggered by malformed HCI ISO data. In the `bt iso recv()` function (subsys/bluetooth/host/iso.c), when processing PB=START/SINGLE fragments, the system attempts to pull a TS SDU header (8 bytes, ts=1) or a non-TS SDU header (4 bytes, ts=0) without verifying that `buf->len` contains the required minimum bytes. While the outer HCI ISO length check in `hci iso()` validates payload length consistency, it does not verify the minimum inner SDU header size. Consequently, a packet with a payload length of 1 can pass `hci iso()` and reach `net buf pull mem()`, which requires `buf->len` to be greater than or equal to the requested length. This leads to a kernel assert and denial of service in assert-enabled builds, or out-of-bounds read behavior in non-assert builds. This issue affects products using the Zephyr Host with `CONFIG BT ISO RX` enabled, especially when incoming HCI data is influenced by a compromised controller or malformed forwarded ISO traffic. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.