CVE-2026-9263

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.0.0 through 3.x

Description An out-of-bounds read exists in the Bluetooth controller ISO Adaptation Layer within the subsys/bluetooth/controller/ll sw/isoal.c file. The issue occurs because the isoal check seg header() function fails to properly validate the length field of a framed ISO PDU start segment. According to the Bluetooth specification, a start segment must have a segment-header length of at least 3 bytes to accommodate the time offset. When a length between 0 and 2 is provided, the isoal rx framed consume() function performs a subtraction that results in an integer underflow, creating an oversized length value. This value is then passed to isoal rx append to sdu(), which copies up to 255 bytes of controller memory beyond the received PDU into an HCI ISO data packet. A remote attacker can trigger this via CIS or BIS-sync HCI data paths or the vendor data path, leading to information disclosure to the host or a denial of service.

Recommendations Update Zephyr to a version where the isoal check seg header() function rejects start segments with a length less than 3 and a guard is implemented before the subtraction in isoal rx framed consume().