CVE-2026-15894 Zephyr Bluetooth Mesh - Buffer Overflow

Zephyr Bluetooth Mesh On-Demand Private Proxy (CONFIG_BT_MESH_OD_PRIV_PROXY_SRV enabled) contains a buffer overflow caused by copying an oversized Solicitation PDU into a fixed 17-byte stack buffer without length bounds, letting remote attackers send crafted unauthenticated advertisements to cause stack overwrite, exploit requires attacker to be in radio range.

CVSS base score 8.8 /10
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Not required
EPSS
0.31% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Buffer Overflow
Impact
Remote Code Execution, Denial Of Service
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
7 October 2026
Updated
15 October 2026
Weakness
CWE-121

Vendor fix

Update to the latest Zephyr version with the fix that trims buf->len to 17 octets before decryption.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs