CVE-2026-15894 zephyrproject CVE debrief

Who should care

Defenders responsible for Zephyr-based systems, particularly those using Bluetooth Mesh On-Demand Private Proxy, should assess exposure and prioritize patching to prevent potential remote code execution and disruption of Bluetooth Mesh networks. Additionally, security teams and vulnerability management teams should review the affected systems and networks to identify potential vulnerabilities and develop compensating controls for exposed systems. Operators

Why it matters

CVE-2026-15894 is a high-severity buffer overflow vulnerability in Zephyr's Bluetooth Mesh On-Demand Private Proxy solicitation handler. Defenders of Zephyr-based systems, especially those utilizing Bluetooth Mesh, should assess exposure and prioritize patching to prevent potential remote code execution and disruption of Bluetooth Mesh networks.

• Potential remote code execution
• Possible disruption of Bluetooth Mesh network
• Increased risk of privilege escalation
• Need for verification of affected versions and patch application

Technical summary

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. This can be triggered by an oversized advertisement, allowing an attacker to write attacker-controlled bytes past the buffer's end. The vulnerability is caused by a lack of input validation in the sol_pdu_decrypt() function, which can lead to potential remote code execution and disruption of Bluetooth Mesh networks. The Bluetooth Mesh On-Demand Private Proxy solicitation handler is vulnerable to buffer overflow attacks due to the lack of input validation.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Verify the affected versions and upgrade to a fixed version
• Implement additional monitoring and logging to detect potential exploitation attempts
• Conduct a thorough review of the affected systems and networks to identify potential vulnerabilities
• Develop and implement compensating controls for exposed systems while remediation is scheduled and verified
• Perform regular security audits and risk assessments to identify potential vulnerabilities
• Track exceptions and retest remediated assets to ensure the effectiveness of the remediation efforts

Evidence notes

The vulnerability is caused by a lack of input validation in the sol_pdu_decrypt() function, which copies a received Solicitation PDU into a fixed 17-byte stack buffer without checking the source length. This can be triggered by an oversized advertisement, allowing an attacker to write attacker-controlled bytes past the buffer's end.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.