CVE-2026-18748

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An issue exists in the Bluetooth Classic A2DP host where the system incorrectly handles codec Information Elements (IE) in the bt a2dp codec ie structure. When an AVDTP peer sends a codec IE longer than 8 bytes, the functions a2dp process config ind(), bt a2dp get config cb(), and bt a2dp set config cb() truncate the copied data to 8 bytes but retain the original, larger length in the len variable. This inconsistency is stored in the bt a2dp stream structure via stream->codec config.

Subsequent operations trust the len value. Specifically, when responding to an AVDTP GET CONFIGURATION request, the a2dp get config ind() function uses net buf add mem() to read and transmit data based on the incorrect len value. This allows a paired BR/EDR peer to trigger an out-of-bounds read of up to approximately 245 bytes of adjacent RAM. Similar out-of-bounds reads can occur within the config req(), reconfig req(), and get config rsp() application callbacks via memcpy().

This issue requires CONFIG BT CLASSIC and CONFIG BT A2DP to be enabled, a paired AVDTP peer, and a local endpoint registered for a non-SBC codec (such as BT A2DP MPEG1, BT A2DP MPEG2, BT A2DP ATRAC, or BT A2DP VENDOR) initialized via BT A2DP EP INIT().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.