CVE-2026-10641

{
  "id": "CVE-2026-10641",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-17T14:17:37.070",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write. During Service Level Connection setup the HF sends AT+CIND=? and parses the AG's +CIND: response in cind_handle(), which assigns a per-entry counter index and calls cind_handle_values() for each list element. cind_handle_values() then wrote hf->ind_table[index] = i without verifying that index is within the 20-element int8_t ind_table[] array of struct bt_hfp_hf. Because the parser places no cap on the number of +CIND: list entries, a remote Attendant Gateway (a malicious, compromised, or spoofed peer the device connects to over Bluetooth) can send a response with more than 20 recognized indicator entries and drive index arbitrarily large, writing a small attacker-positioned value past the array into adjacent struct fields (feature masks, SDP/version state, the calls[] array, work/atomic bookkeeping) and potentially beyond the static connection pool slot. This yields memory corruption and at least denial of service of the Bluetooth host, triggered by a single malformed AT response with no user interaction. The sibling consumer ag_indicator_handle_values() already performed the equivalent bounds check; this commit adds the same index >= ARRAY_SIZE(hf->ind_table) guard to close the gap. Affects builds with CONFIG_BT_HFP_HF enabled; introduced with the original HFP HF CIND parser (~v1.7) and present through v4.4.0."
    },
    {
      "lang": "es",
      "value": "El analizador del rol de manos libres (Hands-Free) del Perfil Manos Libres (HFP) Clásico de Bluetooth de Zephyr (subsys/bluetooth/host/classic/hfp_hf.c) contiene una escritura fuera de límites. Durante la configuración de la Conexión a Nivel de Servicio, el HF envía AT+CIND=? y analiza la respuesta +CIND: del AG en cind_handle(), que asigna un índice de contador por entrada y llama a cind_handle_values() para cada elemento de la lista. cind_handle_values() luego escribió hf-ind_table[index] = i sin verificar que el índice esté dentro del array int8_t ind_table[] de 20 elementos de la estructura bt_hfp_hf. Debido a que el analizador no impone un límite al número de entradas de la lista +CIND:, una Puerta de Enlace de Asistencia (Attendant Gateway) remota (un par malicioso, comprometido o suplantado al que el dispositivo se conecta a través de Bluetooth) puede enviar una respuesta con más de 20 entradas de indicador reconocidas y llevar el índice a un tamaño arbitrariamente grande, escribiendo un pequeño valor posicionado por el atacante más allá del array en campos de estructura adyacentes (máscaras de características, estado de SDP/versión, el array calls[], contabilidad de trabajo/atómica) y potencialmente más allá de la ranura del pool de conexión estática. Esto produce corrupción de memoria y al menos denegación de servicio del host Bluetooth, desencadenado por una única respuesta AT malformada sin interacción del usuario. El consumidor hermano ag_indicator_handle_values() ya realizó la verificación de límites equivalente; este commit añade la misma protección index = ARRAY_SIZE(hf-ind_table) para cerrar la brecha. Afecta a las compilaciones con CONFIG_BT_HFP_HF habilitado; introducido con el analizador HFP HF CIND original (~v1.7) y presente hasta la v4.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/bluetooth/host/classic/hfp_hf.c"
          ],
          "versions": [
            {
              "version": "1.7.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-17T14:59:49.875821Z",
          "id": "CVE-2026-10641",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.7.0",
              "versionEndExcluding": "3.7.3",
              "matchCriteriaId": "F84F7796-3778-4B10-B6DF-A6B3A937F5A4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.3.1",
              "matchCriteriaId": "681D956E-1EA8-40D2-9954-0E6B710FB436"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.4.0",
              "versionEndExcluding": "4.4.2",
              "matchCriteriaId": "1A0A2134-3579-444D-91CA-CCEE3F15995A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/cf7693a8261ae363c9cf46cfd51005486637173e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wx5j-q6f2-59p3",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wx5j-q6f2-59p3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}