{"id":"CVE-2026-19570","summary":"Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state","details":"The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets.\n\nThe defect is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR, so the path is active in every broadcast-sink build once the device is periodic-advertising-synced. An attacker in radio range who operates a broadcast source the device syncs to — or who impersonates the advertiser address and SID of one already in use, periodic advertising data being unauthenticated — can change the BASE at will; each new BASE is re-parsed.\n\nA crafted BASE therefore writes attacker-chosen bytes past the end of a fixed static object in .bss: up to roughly 236 bytes for an oversized metadata LTV, plus whole struct bt_bap_bass_subgroup records for each subgroup beyond CONFIG_BT_BAP_BASS_MAX_SUBGROUPS. This is memory corruption of adjacent Bluetooth-audio state reachable with no pairing, bonding or GATT connection, with a potential for remote code execution in the Bluetooth RX thread; in addition, the unvalidated metadata_len is forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps it nor rejects it, leading to a further copy into the receive state and to out-of-bounds memory being disclosed in the BASS receive-state notification sent to a connected Broadcast Assistant.\n\nThe fix rejects a BASE carrying more subgroups than the receive state can hold (discarding the update entirely) and omits metadata that does not fit rather than copying it, and additionally honours the previously-ignored error return of the subgroup decode pass.","aliases":["GHSA-4qwc-2qfq-w2fj"],"modified":"2026-10-11T07:04:32.914226291Z","published":"2026-10-09T07:16:38.508Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-120","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19570.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19570.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4qwc-2qfq-w2fj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19570"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"468eb56cf242eedba62006ee758700ee6148763f"},{"fixed":"5738f61f4128bb38508bab57342b1f7bf218d127"}],"database_specific":{"extracted_events":[{"introduced":"3.6.0"},{"last_affected":"4.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19570.json","vanir_signatures":[{"digest":{"line_hashes":["89639250881921461428321733328325395888","294756770548867545286660971783345169428","147919520720776713959891958060977182936","330437784143584374398306990005076653296","263866269550027057997884405701701323927","100368840651485477544624688640897078925","21317355058463673021804550469493341671","171306193858979053124820849032683676944","137480847642186527787577572414524410555","286671510545799820835079133343842513345","219449782079088604115569323615446021159","300756553361722182553163320588104765441","324872131229588656947315974873153677179","326938214319867795020884080856408393148","236210081762565214856143168632629490488","70474732998465280343911549596222349156","16702914253146064628034916642210124505","334955931473348912214567269901933348520","186764318817582402233506766846834521356","63085645242609247277882672156219973317","320142875104612695442819300828627545302","217793329716293586420685933015832690571","146344808921182675730013177248591260834","248185320415441973979968873002301706409","46989352758245658183091382236184540568","257468955499649971584173209169582481804","127145588533842498850749236385316758332","25862518420509608550001969689439013657","203076724754729896877732942242500579141","47305627175546948212043768138541075764","232411976727801904875176552218328318974","190838669744768008172034326141061673154","252250421692066261362275429512465793781","91660480997662025190469972315819837787","67202442240704222351163961096604165192"],"threshold":0.9},"id":"CVE-2026-19570-33be8b0c","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127","target":{"file":"subsys/bluetooth/audio/bap_broadcast_sink.c"},"deprecated":false},{"id":"CVE-2026-19570-46b578a1","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127","target":{"file":"subsys/bluetooth/audio/bap_broadcast_sink.c","function":"update_recv_state_base"},"deprecated":false,"digest":{"function_hash":"64071744143067070331746692490497919891","length":995}},{"id":"CVE-2026-19570-a769d02f","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127","target":{"function":"pa_decode_base","file":"subsys/bluetooth/audio/bap_broadcast_sink.c"},"deprecated":false,"digest":{"length":1246,"function_hash":"284122061243721422781664067113559513744"}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127","target":{"file":"subsys/bluetooth/audio/bap_broadcast_sink.c","function":"base_subgroup_meta_cb"},"deprecated":false,"digest":{"length":411,"function_hash":"107322468742867694739652278569837039801"},"id":"CVE-2026-19570-be34dd00","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"322917616491296625524941897903834597006","length":1037},"id":"CVE-2026-19570-d88db7ef","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/5738f61f4128bb38508bab57342b1f7bf218d127","target":{"file":"subsys/bluetooth/audio/bap_broadcast_sink.c","function":"base_decode_subgroup_cb"}}],"vanir_signatures_modified":"2026-10-11T07:04:32Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}