Adjacent memory corruption via solicitation length underflow
Published Jun 4, 2026 · Updated Jun 4, 2026
Out-of-bounds write in Zephyr RTOS 4.3.0 and earlier allows physically proximate attackers to corrupt memory via BLE advertisements. In bt_mesh_sol_recv(), an unchecked length below three underflows during integer promotion and becomes a huge size_t passed to net_buf_simple_pull_mem(), moving the buffer pointer out of bounds. The path requires CONFIG_BT_MESH_OD_PRIV_PROXY_SRV and no pairing; release builds without assertions can crash, while memory corruption can enable code execution.
Summary
What happened
Out-of-bounds write in Zephyr RTOS 4.3.0 and earlier allows physically proximate attackers to corrupt memory via BLE advertisements. In bt_mesh_sol_recv(), an unchecked length below three underflows during integer promotion and becomes a huge size_t passed to net_buf_simple_pull_mem(), moving the buffer pointer out of bounds. The path requires CONFIG_BT_MESH_OD_PRIV_PROXY_SRV and no pairing; release builds without assertions can crash, while memory corruption can enable code execution.
The record
- CVE
- CVE-2026-5589
- Published
- Jun 4, 2026
- Updated
- Jun 4, 2026
- Vendor
- Zephyr Project
- Product
- Zephyr RTOS
- Classifications
- CWE-787
- Attack vector
- adjacent
- Privileges
- unauthenticated
Timeline
How it unfolded
- Jun 4, 2026CVE publishedPublication date reported by the CVE source.
- Jun 4, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=* <=4.3.0
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo