CVE-2026-10641: Zephyr Bluetooth Classic HFP Out-of-Bounds Write Vulnerability

Technical summary

CVE-2026-10641 is an out-of-bounds write vulnerability in the Zephyr RTOS Bluetooth Classic Hands-Free Profile (HFP) implementation, specifically in the CIND response parser (subsys/bluetooth/host/classic/hfp_hf.c). During Service Level Connection establishment, the Hands-Free role processes the Attendant Gateway's +CIND: indicator list response. The parser increments a per-entry counter index and invokes cind_handle_values() for each list element. However, cind_handle_values() writes to hf->ind_table[index] without validating that index remains within the bounds of the 20-element int8_t ind_table array. A remote AG can send a +CIND: response containing more than 20 indicator entries, causing index to exceed array bounds and write attacker-controlled values into adjacent struct fields including feature masks, SDP/version state, the calls[] array, and connection pool metadata. The sibling AG-side parser (ag_indicator_handle_values()) already implements the necessary bounds check via index >= ARRAY_SIZE(hf->ind_table); this check was absent from the HF-side consumer. The vulnerability affects all builds with CONFIG_BT_HFP_HF enabled, from initial HFP HF CIND parser introduction (~v1.7) through v4.4.0.

Business impact

Organizations deploying Zephyr-based Bluetooth Classic devices—including wireless headsets, speakers, automotive hands-free systems, and IoT peripherals—face denial-of-service and potential data corruption risks. An attacker within Bluetooth range can force affected devices into a non-functional state without user action, disrupting critical communications features in phones, vehicles, or industrial equipment. If memory corruption extends into shared Bluetooth state or adjacent subsystem data, secondary impacts such as information disclosure or further system instability become possible. The attack surface is particularly broad in populated Bluetooth environments (offices, vehicles, public spaces) where an attacker need not pair with the target device—only transmit a malformed response during connection setup.

Affected systems

Zephyr RTOS versions from approximately v1.7 through v4.4.0 with CONFIG_BT_HFP_HF enabled. The vulnerability exists in the HFP Hands-Free role implementation and is exploitable when a Zephyr device connects to a remote Bluetooth Classic device (real, compromised, or spoofed). Any Zephyr-based product using Hands-Free Profile for audio calls is potentially affected, including consumer electronics, automotive infotainment systems, industrial IoT gateways, and wearable devices. Systems not using HFP HF or with CONFIG_BT_HFP_HF disabled are not vulnerable.

Exploitability

Exploitability is high relative to the attack constraints. The vulnerability requires adjacent network access (Bluetooth range, typically 10–100 meters depending on power class) and no authentication, pairing, or user interaction. The attacker only needs to intercept or spoof the Attendant Gateway role during Hands-Free Service Level Connection setup and transmit a single malformed +CIND: response. No special tools or zero-day techniques are required; the attack leverages the absence of a bounds check already present in the equivalent AG-side parser. The low barrier to triggering a denial-of-service and the potential for memory corruption make this a practical attack in threat scenarios involving proximity-based adversaries or compromised Bluetooth peripherals.

Remediation

Apply patches from the Zephyr project that add index bounds validation (index >= ARRAY_SIZE(hf->ind_table) check) to cind_handle_values() in the Hands-Free role parser. Verify the patch against the official Zephyr repository for the appropriate maintenance branch and release schedule. Organizations should prioritize patching Zephyr versions v4.4.0 and earlier where CONFIG_BT_HFP_HF is enabled. In the interim, disable CONFIG_BT_HFP_HF in builds where Hands-Free functionality is not required, or restrict Bluetooth Classic connections to trusted peer devices via link policy or allowlisting mechanisms.

Patch guidance

Check the Zephyr project's official advisories and release notes for patched versions addressing this out-of-bounds write. The fix involves adding a bounds check before writing to hf->ind_table[index], mirroring the existing guard in ag_indicator_handle_values(). Organizations using custom Zephyr builds should verify that their build includes the patch and that CONFIG_BT_HFP_HF remains enabled only where Hands-Free functionality is genuinely required. Validate patches by cross-referencing the Zephyr GitHub repository's commit history and release schedules. Consider incorporating this patch into your regular maintenance and release cycles.

Detection guidance

Monitor Bluetooth Classic connection logs for unexpected disconnections or resets during Service Level Connection setup, particularly those coinciding with HFP CIND exchange. Packet capture and protocol analysis (using tools like Wireshark with Bluetooth Classic dissectors) may reveal +CIND: responses with abnormally large indicator lists (significantly exceeding 20 entries). System-level monitoring for memory corruption symptoms—kernel crashes, Bluetooth subsystem faults, or unexpected state changes in Bluetooth-dependent applications—can indicate exploitation. Implement integrity checks or watch for unscheduled Bluetooth host restarts following remote device connections. Because this is a single-packet trigger with no user interaction required, behavioral monitoring of Bluetooth peripheral interactions in high-density environments (offices, public spaces) is valuable for detecting attack attempts.

Why prioritize this

This vulnerability scores CVSS 7.1 (HIGH) due to the combination of low attack complexity, no user interaction, local network adjacency, and high availability impact. While confidentiality is not directly affected, the integrity and availability impacts—memory corruption and denial of service—pose meaningful risk to Bluetooth-dependent systems. The lack of CISA KEV listing does not diminish priority; the ease of exploitation and broad applicability across Zephyr Bluetooth Classic devices justify urgent patching. Organizations with Zephyr-based Hands-Free devices in production environments should elevate this to high priority.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: Attack Vector Adjacent Network (AV:A)—exploitable only within Bluetooth range; Attack Complexity Low (AC:L)—no special conditions or user interaction required; Privileges Required None (PR:N)—the attacker needs no prior relationship with the target; User Interaction None (UI:N)—the attack is automatic upon a malformed response; Scope Unchanged (S:U)—impact is confined to the vulnerable Bluetooth host; Confidentiality None (C:N)—no information disclosure; Integrity Low (I:L)—memory corruption with limited scope; Availability High (A:H)—denial of service of the Bluetooth subsystem. The score appropriately weights the practical exploitability and impact within the Bluetooth domain.

Frequently asked questions