CVE-2026-10593

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10593", "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "state": "PUBLISHED", "assignerShortName": "zephyr", "dateReserved": "2026-06-01T21:19:25.050Z", "datePublished": "2026-06-28T04:28:22.888Z", "dateUpdated": "2026-11-04T04:58:21.299Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "shortName": "zephyr", "dateUpdated": "2026-11-04T04:58:21.299Z"}, "title": "Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling", "descriptions": [{"lang": "en", "value": "The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()).\n\nA malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state \u2014 a transition the dispatcher explicitly permits \u2014 during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled.\n\nThe defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep->qos struct, eliminating the NULL dereference."}], "affected": [{"vendor": "zephyrproject", "product": "zephyr", "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "packageName": "zephyr", "defaultStatus": "unaffected", "programFiles": ["include/zephyr/bluetooth/audio/bap.h", "subsys/bluetooth/audio/ascs.c", "subsys/bluetooth/audio/bap_broadcast_sink.c", "subsys/bluetooth/audio/bap_broadcast_source.c", "subsys/bluetooth/audio/bap_endpoint.h", "subsys/bluetooth/audio/bap_stream.c", "subsys/bluetooth/audio/bap_unicast_client.c", "subsys/bluetooth/audio/bap_unicast_client_internal.h"], "versions": [{"version": "4.3.0", "status": "affected", "versionType": "semver", "lessThan": "4.5.0"}]}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f", "name": "Fix commit 52f25c903f29", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/commit/ff26f33f35e8944230717c3bf861063050c21d73", "name": "Fix commit ff26f33f35e8", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-22q8-m94g-2pwh", "name": "GHSA-22q8-m94g-2pwh"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "memory-safety", "cweId": "CWE-476", "type": "CWE"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-29T13:47:33.621798Z", "id": "CVE-2026-10593", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T13:47:51.924Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10593", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T13:47:33.621798Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T13:47:45.450Z"}}], "cna": {"title": "Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "4.3.0", "lessThan": "4.5.0", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["include/zephyr/bluetooth/audio/bap.h", "subsys/bluetooth/audio/ascs.c", "subsys/bluetooth/audio/bap_broadcast_sink.c", "subsys/bluetooth/audio/bap_broadcast_source.c", "subsys/bluetooth/audio/bap_endpoint.h", "subsys/bluetooth/audio/bap_stream.c", "subsys/bluetooth/audio/bap_unicast_client.c", "subsys/bluetooth/audio/bap_unicast_client_internal.h"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f", "name": "Fix commit 52f25c903f29", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/commit/ff26f33f35e8944230717c3bf861063050c21d73", "name": "Fix commit ff26f33f35e8", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-22q8-m94g-2pwh", "name": "GHSA-22q8-m94g-2pwh"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()).\n\nA malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state \u2014 a transition the dispatcher explicitly permits \u2014 during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled.\n\nThe defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep->qos struct, eliminating the NULL dereference."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "memory-safety"}]}], "providerMetadata": {"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "shortName": "zephyr", "dateUpdated": "2026-11-04T04:58:21.299Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10593", "state": "PUBLISHED", "dateUpdated": "2026-11-04T04:58:21.299Z", "dateReserved": "2026-06-01T21:19:25.050Z", "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "datePublished": "2026-06-28T04:28:22.888Z", "assignerShortName": "zephyr"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected", "packageName": "zephyr", "product": "zephyr", "programFiles": ["include/zephyr/bluetooth/audio/bap.h", "subsys/bluetooth/audio/ascs.c", "subsys/bluetooth/audio/bap_broadcast_sink.c", "subsys/bluetooth/audio/bap_broadcast_source.c", "subsys/bluetooth/audio/bap_endpoint.h", "subsys/bluetooth/audio/bap_stream.c", "subsys/bluetooth/audio/bap_unicast_client.c", "subsys/bluetooth/audio/bap_unicast_client_internal.h"], "vendor": "zephyrproject", "versions": [{"lessThan": "4.5.0", "status": "affected", "version": "4.3.0", "versionType": "semver"}]}], "source": "vulnerabilities@zephyrproject.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB673835-4CCD-49A7-9873-630B9EE2C814", "versionEndIncluding": "4.4.1", "versionStartIncluding": "4.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()).\n\nA malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state \u2014 a transition the dispatcher explicitly permits \u2014 during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled.\n\nThe defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep->qos struct, eliminating the NULL dereference."}, {"lang": "es", "value": "El cliente unicast del perfil de audio b\u00e1sico (BAP) de Zephyr Bluetooth LE Audio gestiona incorrectamente las notificaciones de estado de ASE suministradas por el par. En unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), el gestor escribe campos QoS controlados por el atacante (intervalo, encuadre, phy, sdu, rtn, latencia, pd) a trav\u00e9s del puntero stream-qos con solo una protecci\u00f3n stream != NULL. stream-qos es NULL para cualquier flujo que haya sido configurado por c\u00f3dec a trav\u00e9s de bt_bap_stream_config() pero que a\u00fan no se haya a\u00f1adido a un grupo unicast (se establece solo por unicast_group_add_stream()). Un servidor ASCS remoto malicioso o con errores, al que el dispositivo local est\u00e1 conectado como un cliente unicast BAP, puede enviar una notificaci\u00f3n GATT anunciando que el ASE ha entrado en el estado QoS Configurado mientras el punto final local todav\u00eda est\u00e1 en el estado Codec Configurado - una transici\u00f3n que el despachador permite expl\u00edcitamente - durante esa ventana, causando una escritura a trav\u00e9s de un puntero NULL y un fallo (denegaci\u00f3n de servicio). Los datos escritos est\u00e1n controlados remotamente. El defecto estaba presente en v4.3.0 y v4.4.0 (y anteriores). La soluci\u00f3n redirige todo el almacenamiento QoS de BAP a la estructura ep-qos incrustada siempre v\u00e1lida, eliminando la desreferencia de NULL."}], "id": "CVE-2026-10593", "lastModified": "2026-11-04T05:18:21.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "vulnerabilities@zephyrproject.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10593", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-29T13:47:33.621798Z", "version": "2.0.3"}}]}, "published": "2026-06-28T05:16:20.097", "references": [{"source": "vulnerabilities@zephyrproject.org", "tags": ["Patch"], "url": "https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f"}, {"source": "vulnerabilities@zephyrproject.org", "url": "https://github.com/zephyrproject-rtos/zephyr/commit/ff26f33f35e8944230717c3bf861063050c21d73"}, {"source": "vulnerabilities@zephyrproject.org", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-22q8-m94g-2pwh"}], "sourceIdentifier": "vulnerabilities@zephyrproject.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "vulnerabilities@zephyrproject.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,4.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "zephyr", "source": "cna", "vendor": "zephyrproject"}, "product": "zephyr", "vendor": "zephyrproject"}], "created": "2026-06-28T06:30:04.926904+00:00", "updated": "2026-08-02T01:30:04.443856+00:00", "vendors": ["zephyrproject", "zephyrproject$PRODUCT$zephyr"]}