CVE-2026-10641

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.7 through 4.4.0

Description The Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser in subsys/bluetooth/host/classic/hfp hf.c contains an out-of-bounds write. During Service Level Connection setup, the Hands-Free (HF) unit sends AT+CIND=? and parses the Attendant Gateway (AG) response in the cind handle() function, which assigns a per-entry counter index and calls cind handle values() for each list element. The cind handle values() function writes to hf-ind table[index] without verifying that the index is within the 20-element int8 t ind table[] array of struct bt hfp hf. Since the parser does not limit the number of +CIND: list entries, a remote Attendant Gateway can send a response with more than 20 entries to drive the index arbitrarily large. This allows writing values past the array into adjacent struct fields, such as feature masks, SDP/version state, the calls[] array, and work/atomic bookkeeping, potentially extending beyond the static connection pool slot. This results in memory corruption and denial of service of the Bluetooth host, triggered by a single malformed AT response without user interaction.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary workaround, disable CONFIG BT HFP HF to mitigate the risk of exploitation.