{"id":"CVE-2026-19570","published":"2026-10-09T08:16:54.693","lastModified":"2026-10-09T18:17:07.887","description":"The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets.\n\nThe defect is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR, so the path is active in every broadcast-sink build once the device is periodic-advertising-synced. An attacker in radio range who operates a broadcast source the device syncs to — or who impersonates the advertiser address and SID of one already in use, periodic advertising data being unauthenticated — can change the BASE at will; each new BASE is re-parsed.\n\nA crafted BASE therefore writes attacker-chosen bytes past the end of a fixed static object in .bss: up to roughly 236 bytes for an oversized metadata LTV, plus whole struct bt_bap_bass_subgroup records for each subgroup beyond CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. This is memory corruption of adjacent Bluetooth-audio state reachable with no pairing, bonding or GATT connection, with a potential for remote code execution in the Bluetooth RX thread; in addition, the unvalidated metadata_len is forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps it nor rejects it, leading to a further copy into the receive state and to out-of-bounds memory being disclosed in the BASS receive-state notification sent to a connected Broadcast Assistant.\n\nThe fix rejects a BASE carrying more subgroups than the receive state can hold (discarding the update entirely) and omits metadata that does not fit rather than copying it, and additionally honours the previously-ignored error return of the subgroup decode pass.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-120","CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127","tags":[]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4qwc-2qfq-w2fj","tags":[]}],"exploitRefs":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127","tags":[]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4qwc-2qfq-w2fj","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw in the LE Audio Broadcast Sink allows an attacker to overflow the metadata buffer by sending a crafted Basic Audio Announcement (BASE) with excessive subgroup metadata, leading to potential code execution or data corruption.","exploitability":"Exploitation is moderately hard as it requires crafting a specific BASE with metadata exceeding the buffer size. The attacker must be within radio range and the device must be periodic-advertising-synced.","blast_radius":"If exploited, the flaw could lead to denial of service or arbitrary code execution on the device, impacting the audio subsystem and potentially other services.","remediation":"Upgrade to the version 5.5.0 or later, as the fix is included in this release.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","ble","audio","iot"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:44:38.049Z"}}