Description
The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE on the Host layer.
Scores
CVSS v3
5.9
EPSS
0.0022
EPSS Percentile
44.8%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-416
CWE-672
Status
published
Products (1)
zephyrproject/zephyr
< 3.3.0
Published
Jul 10, 2023
Tracked Since
Feb 18, 2026