PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10641 zephyrproject CVE debrief

Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser contains an out-of-bounds write vulnerability. During Service Level Connection setup, a remote Attendant Gateway can send a malformed AT response with more than 20 recognized indicator entries, causing memory corruption and denial of service of the Bluetooth host. This issue affects builds with CONFIG_BT_HFP_HF enabled and was introduced with the original HFP HF CIND parser (~v1.7) and present through v4.4.0.

Vendor
zephyrproject
Product
zephyr
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-07-14
Advisory published
2026-06-17
Advisory updated
2026-07-14

Who should care

Organizations using Zephyr's Bluetooth Classic HFP feature, particularly those with devices that connect to Bluetooth devices over the Hands-Free Profile, should be aware of this vulnerability. This includes manufacturers of Bluetooth-enabled devices, automotive and industrial equipment suppliers, and developers of Bluetooth-based applications.

Technical summary

The vulnerability is caused by the lack of bounds checking in the cind_handle_values() function, which writes to the hf-ind_table[] array without verifying that the index is within the array bounds. This allows a remote attacker to send a response with more than 20 recognized indicator entries, driving the index arbitrarily large and writing a small attacker-positioned value past the array into adjacent struct fields. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity.

Defensive priority

High

Recommended defensive actions

  • Update to a version of Zephyr that includes the fix for CVE-2026-10641
  • Disable CONFIG_BT_HFP_HF if not required
  • Implement additional bounds checking for the cind_handle_values() function
  • Monitor Bluetooth connections for suspicious activity
  • Consider using a different Bluetooth profile or protocol
  • Limit the number of indicator entries in the +CIND: response
  • Implement memory protection mechanisms to prevent exploitation

Evidence notes

The vulnerability was introduced with the original HFP HF CIND parser (~v1.7) and present through v4.4.0. The issue was fixed with the commit cf7693a8261ae363c9cf46cfd51005486637173e. The vulnerability has been reported to the Zephyr project and a fix has been provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10641 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10641

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10641 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10641

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.