CVE-2025-12890 Bluetooth: peripheral: Invalid handling of malformed connection request
Attackers can crash Zephyr RTOS Bluetooth peripherals by sending malformed connection requests, rendering the device unconnectable.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12890?
CVE-2025-12890 is a medium-severity denial of service vulnerability in zephyrproject-rtos Zephyr, published on 7 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.
Weakness: CWE-703
Which versions are affected by CVE-2025-12890?
How do I fix CVE-2025-12890?
No fix has been published for CVE-2025-12890 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-12890 being exploited?
There is no known exploitation of CVE-2025-12890 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-8hrf-pfww-83v9.