# CVE-2026-10651: Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)

> A remote Bluetooth peer can cause a denial of service in Zephyr RTOS by sending a malformed SDP record that triggers an out-of-bounds read.

- **Severity:** High 7.1 (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 22 Jun 2026
- **Updated:** 15 Oct 2026
- **Also known as:** GHSA-p93g-3r68-cj53, UBUNTU-CVE-2026-10651

## What is CVE-2026-10651?

CVE-2026-10651 is a high-severity denial of service vulnerability in Zephyrproject Zephyr, published on 22 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descriptor (type), via net_buf_simple_pull_u8(). Because net_buf_simple_pull_u8() dereferences buf->data[0] before its only bounds guard (an __ASSERT_NO_MSG that compiles out when CONFIG_ASSERT is disabled, the production default), a record of exactly three bytes (0x09 followed by a 2-byte attribute ID) causes a one-byte read past the end of the logical buffer. The parser is reachable from inbound, remote-controlled data: a Bluetooth BR/EDR peer acting as an SDP server returns discovery-response records that are stored verbatim in the client receive buffer and parsed via the public bt_sdp_get_attr()/bt_sdp_has_attr()/bt_sdp_record_parse() helpers. The over-read is bounded to a single byte that is used only as an internal length selector and is never leaked to the attacker; subsequent length checks then reject the malformed record. Realistic impact is therefore limited to an edge-case denial of service (a fault only if the record ends exactly at a mapped-memory boundary, or a deterministic assert panic when CONFIG_ASSERT=y). Affects Zephyr v4.3.0 and v4.4.0; fixed by adding sizeof(type) to the length check.

Weakness: CWE-617 (Reachable Assertion), CWE-20 (Improper Input Validation)

## Which versions are affected by CVE-2026-10651?

It affects 1 product.


Products: Zephyrproject Zephyr.

## How do I fix CVE-2026-10651?

No fix has been published for CVE-2026-10651 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-10651 being exploited?

There is no known exploitation of CVE-2026-10651 in the wild and no public exploit code.

## Other vulnerabilities in Zephyrproject Zephyr

- [CVE-2026-5067](https://insights.sbomify.com/CVE-2026-5067/): Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key (critical 9.8)
- [CVE-2022-3806](https://insights.sbomify.com/CVE-2022-3806/): Bluetooth HCI Error Handling Double Free (critical 9.8)
- [CVE-2017-14199](https://insights.sbomify.com/CVE-2017-14199/): Memory corruption in getaddrinfo (critical 9.8)
- [CVE-2018-1000800](https://insights.sbomify.com/CVE-2018-1000800/): Null dereference in n/a (critical 9.8)
- [CVE-2021-3329](https://insights.sbomify.com/CVE-2021-3329/): DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer (critical 9.6)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-10651 and fix it if it is affected.

What it is: CVE-2026-10651 is a high-severity denial of service vulnerability in Zephyrproject Zephyr, published on 22 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-10651 in the wild and no public exploit code.

Affected product: Zephyrproject Zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-10651/ (Markdown: https://insights.sbomify.com/CVE-2026-10651/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-10651
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-10651
- OSV: https://osv.dev/vulnerability/CVE-2026-10651

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-10651/
Summaries are generated and may contain mistakes; the official description above is the record.