CVE-2026-10593

{
  "id": "CVE-2026-10593",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-28T05:16:20.097",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE state notifications. In unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), the handler writes attacker-controlled QoS fields (interval, framing, phy, sdu, rtn, latency, pd) through the stream->qos pointer with only a stream != NULL guard. stream->qos is NULL for any stream that has been codec-configured via bt_bap_stream_config() but not yet added to a unicast group (it is set only by unicast_group_add_stream()).\n\nA malicious or buggy remote ASCS server, to which the local device is connected as a BAP unicast client, can send a GATT notification announcing the ASE has entered the QoS Configured state while the local endpoint is still in the Codec Configured state — a transition the dispatcher explicitly permits — during that window, causing a write through a NULL pointer and a crash (denial of service). The data written is itself remote-controlled.\n\nThe defect shipped in v4.3.0 and v4.4.0 (and earlier). The fix re-points all BAP QoS storage to the always-valid embedded ep->qos struct, eliminating the NULL dereference."
    },
    {
      "lang": "es",
      "value": "El cliente unicast del perfil de audio básico (BAP) de Zephyr Bluetooth LE Audio gestiona incorrectamente las notificaciones de estado de ASE suministradas por el par. En unicast_client_ep_qos_state() (subsys/bluetooth/audio/bap_unicast_client.c), el gestor escribe campos QoS controlados por el atacante (intervalo, encuadre, phy, sdu, rtn, latencia, pd) a través del puntero stream-qos con solo una protección stream != NULL. stream-qos es NULL para cualquier flujo que haya sido configurado por códec a través de bt_bap_stream_config() pero que aún no se haya añadido a un grupo unicast (se establece solo por unicast_group_add_stream()). Un servidor ASCS remoto malicioso o con errores, al que el dispositivo local está conectado como un cliente unicast BAP, puede enviar una notificación GATT anunciando que el ASE ha entrado en el estado QoS Configurado mientras el punto final local todavía está en el estado Codec Configurado - una transición que el despachador permite explícitamente - durante esa ventana, causando una escritura a través de un puntero NULL y un fallo (denegación de servicio). Los datos escritos están controlados remotamente. El defecto estaba presente en v4.3.0 y v4.4.0 (y anteriores). La solución redirige todo el almacenamiento QoS de BAP a la estructura ep-qos incrustada siempre válida, eliminando la desreferencia de NULL."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "include/zephyr/bluetooth/audio/bap.h",
            "subsys/bluetooth/audio/ascs.c",
            "subsys/bluetooth/audio/bap_broadcast_sink.c",
            "subsys/bluetooth/audio/bap_broadcast_source.c",
            "subsys/bluetooth/audio/bap_endpoint.h",
            "subsys/bluetooth/audio/bap_stream.c",
            "subsys/bluetooth/audio/bap_unicast_client.c",
            "subsys/bluetooth/audio/bap_unicast_client_internal.h"
          ],
          "versions": [
            {
              "version": "4.3.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T13:47:33.621798Z",
          "id": "CVE-2026-10593",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.3.0",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "AB673835-4CCD-49A7-9873-630B9EE2C814"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/52f25c903f2926cb1281b50fd79654668e2d483f",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-22q8-m94g-2pwh",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}