{"id":"CVE-2026-18748","summary":"Out-of-bounds read in Bluetooth Classic A2DP codec information element handling","details":"The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte codec_ie[] array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp_process_config_ind() in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes but assigned the full, attacker-chosen length to len, and then persisted that inconsistent structure into the application's struct bt_a2dp_stream via stream-\u003ecodec_config. bt_a2dp_get_config_cb() and bt_a2dp_set_config_cb() had the same truncate-the-copy-but-keep-the-length pattern.\n\nEvery later consumer trusts len. In particular the responder for an incoming AVDTP GET_CONFIGURATION, a2dp_get_config_ind(), executes net_buf_add_mem(rsp_buf, &ep-\u003estream-\u003ecodec_config.codec_ie[0], ep-\u003estream-\u003ecodec_config.len), so a paired BR/EDR peer that first sends a SET_CONFIGURATION carrying an oversized codec IE and then requests the configuration back causes the stack to read up to roughly 245 bytes past the end of the 8-byte array and transmit them in the response. codec_config is the last member of struct bt_a2dp_stream, so the read runs into memory adjacent to the application's stream object. The same inconsistency is also handed to the config_req(), reconfig_req() and get_config_rsp() application callbacks, where a natural memcpy() of len bytes performs a further out-of-bounds read.\n\nReaching the on-air disclosure requires CONFIG_BT_CLASSIC with CONFIG_BT_A2DP, an AVDTP peer that has completed pairing (the AVDTP L2CAP channel requires BT_SECURITY_L2), and a local endpoint registered for a non-SBC codec — BT_A2DP_MPEG1/BT_A2DP_MPEG2/BT_A2DP_ATRAC/BT_A2DP_VENDOR via BT_A2DP_EP_INIT() — because the SBC branch already pins the IE length to 4 bytes. The bt_a2dp_get_config_cb() response path has no such gate and hands the lying length to any application. There is no out-of-bounds write: the net_buf tailroom check bounds the destination, so the impact is limited to disclosure of a bounded region of adjacent RAM to the peer.\n\nThe fix replaces the hardcoded BT_A2DP_MAX_IE_LENGTH with the configurable CONFIG_BT_A2DP_CODEC_MAX_IE_LEN (default 8, range 4–253), sizes codec_ie[] from it, and rejects any received IE that exceeds it instead of silently truncating, so len can no longer exceed the number of valid bytes.","aliases":["GHSA-6qq5-25mp-x5rg"],"modified":"2026-10-22T07:26:23.555578169Z","published":"2026-10-21T18:19:29.937Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18748.json","cna_assigner":"zephyr","cwe_ids":["CWE-125"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18748.json"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6qq5-25mp-x5rg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18748"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"3568e1b6d5cdd51a6b964a2a1d6d29200fea2056"},{"last_affected":"dccb09599635bdff17633fa7e9dab014b91dce90"},{"fixed":"c5f649f4714e625362fbaa93ffd7419f9c27342b"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"4.3.0"},{"last_affected":"4.4.2"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"c5f649f4714e625362fbaa93ffd7419f9c27342b"}]}]}}],"versions":["v4.4.2","v4.4.2-rc1","v4.4.1","v4.4.1-rc1","v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18748.json","vanir_signatures":[{"id":"CVE-2026-18748-1a0d3a1a","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"file":"subsys/bluetooth/host/classic/a2dp.c","function":"bt_a2dp_stream_config_set_param"},"deprecated":false,"digest":{"function_hash":"87407497791837019938873558990256730305","length":730}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"file":"subsys/bluetooth/host/classic/a2dp.c","function":"bt_a2dp_set_config_cb"},"deprecated":false,"digest":{"length":917,"function_hash":"251858120939401031253399303295772424026"},"id":"CVE-2026-18748-42a4bc40","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"file":"subsys/bluetooth/host/classic/a2dp.c","function":"bt_a2dp_stream_reconfig"},"deprecated":false,"digest":{"function_hash":"220678699082149653779564746458687029022","length":679},"id":"CVE-2026-18748-48f37136","signature_type":"Function"},{"digest":{"line_hashes":["315750874642157258908764089539116243205","295437334817636245536108105379826141827","323006997778431745983966106561447675401","74335997703668601599167297338756561916","102391262494144234775584777433465993374","325080182428995550429213689099572652238","219686147730634377348875623562576513185","152167662905474630239241523636055925501","247911575884224932740552126980877111213","109737139386765966999010658015758588407","118788491841874478708900331187097485421","309689398287972442880885911382405847209","44664580401000686266948531333791733793","45549655288646506649613474970321220991","11050927864294038804974405770553054863","324913485557161905411252305261077407231","90784456051375423408208820339332496878","197847307089829910106689545428656849660","100698663799923159663666016148139708971","46515746175890116678061096441556753310","57740446099397135944872382486899233518","301376730780956439818002351286650485886","251747985091792202612423876508084284421","233292373506280462151963481186261461087","297741141682296565266064478751852773452","290905397491811632270744273057341557938","17976209018534851740187327748161586731","167874666620836706043293130392618135366","132489806046994308984444815828959272001","153941775410180503917944124641193903547","302624562056812244677389439584087768760","101477178519085186699076374536043435108","110670935243481368615134668684245165215","13812052642305918245851293876514527388","205878631339865009558161121435348817277","37051233185177627409609030757847135953","300790291563189719085584218205322569230","28107063654660939597586512896299303736","161464449026108714456545268167433705949","321743091867209395413780459692849488334","117565417289981502269496986154478929926","19719489339128625147891927279367408071","152930348117392847099378294624271265195","174869182677007269620260037631659787296","136732623164173974462740092596343263010","339427913226632351119450676061090887259","50144596379553729930853163786895383324","329803739641411855096743441966705355446","309114697107075920828665249511169170986","267868390585593816517915983992887850017","109789575659412514693059533498223388041","28440622809845629422611806668356889240","212211897836344782203704256934308472634","122497356599630472233239145867207972873","61880177349985417810154157560868683960","143449542484999295894518718479580182552","233662887196971127157040335689415868190","181543273252830995193154897733249601149","239728238631719311967129447083580856179","206043713942727775637678504589003515941","48218301809640419875701725830900435660","283256482044775623830667909325516362807","6291614159548182537161930990493990972","8298384745944457677399949120898579346","192926709752910177357971438041500342378","74335997703668601599167297338756561916","102391262494144234775584777433465993374","325080182428995550429213689099572652238","179987382981783601389892580988901961502","222041742780573646409989695289576641277","4224486312105014076591209900812231719","105108279492462277319628685537828667086","164691109189463071713097226636097770400","137950783998460674006835831412983951959","149037439263021382107381964334388923362"],"threshold":0.9},"id":"CVE-2026-18748-5cc25f75","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"file":"subsys/bluetooth/host/classic/a2dp.c"},"deprecated":false},{"deprecated":false,"digest":{"length":1176,"function_hash":"329261428119773976962961292531859262537"},"id":"CVE-2026-18748-928264c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"file":"subsys/bluetooth/host/classic/a2dp.c","function":"bt_a2dp_stream_config"}},{"id":"CVE-2026-18748-934d2f41","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"function":"bt_a2dp_get_config_cb","file":"subsys/bluetooth/host/classic/a2dp.c"},"deprecated":false,"digest":{"function_hash":"85347422737144647277866803898861399210","length":1010}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"function":"a2dp_process_config_ind","file":"subsys/bluetooth/host/classic/a2dp.c"},"deprecated":false,"digest":{"function_hash":"140674588605193527718897024581031386037","length":2053},"id":"CVE-2026-18748-9683b0fa"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"function":"bt_a2dp_get_capabilities_cb","file":"subsys/bluetooth/host/classic/a2dp.c"},"deprecated":false,"digest":{"function_hash":"224861269593236494486863542204613522516","length":1537},"id":"CVE-2026-18748-a4b27af6","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/c5f649f4714e625362fbaa93ffd7419f9c27342b","target":{"file":"include/zephyr/bluetooth/classic/a2dp.h"},"deprecated":false,"digest":{"line_hashes":["286453912675025196355352590566251185316","271419047730790638914577317343261531531","13897902785678072014820323739121711485","280323171310482767342971033648467592400","13819168669319062741861946175523449037","212450964863221899568734953826615564582","206999016860970813862767915572892516663"],"threshold":0.9},"id":"CVE-2026-18748-fbd50513"}],"vanir_signatures_modified":"2026-10-22T07:26:23Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}