CVE-2026-18748: Bluetooth A2DP Information Disclosure

CVE-2026-18748 Overview

CVE-2026-18748 is an out-of-bounds read vulnerability [CWE-125] in the Zephyr RTOS Bluetooth Classic A2DP host stack. The flaw resides in how the stack handles a codec Information Element (IE) stored in struct bt_a2dp_codec_ie, which pairs a one-byte len field with a fixed 8-byte codec_ie[] array. When an Audio/Video Distribution Transport Protocol (AVDTP) peer sends a codec IE longer than 8 bytes, the stack truncates the copy but preserves the attacker-chosen length. A paired BR/EDR peer can later request the configuration back and receive adjacent RAM contents in the response.

Critical Impact
An authenticated adjacent Bluetooth peer can disclose up to ~245 bytes of memory adjacent to the application's A2DP stream object.

Affected Products

Zephyr RTOS builds with CONFIG_BT_CLASSIC and CONFIG_BT_A2DP enabled
Applications registering non-SBC A2DP endpoints (BT_A2DP_MPEG1, BT_A2DP_MPEG2, BT_A2DP_ATRAC, BT_A2DP_VENDOR)
Any A2DP responder exposing bt_a2dp_get_config_cb() to paired peers

Discovery Timeline

2026-10-21 - CVE CVE-2026-18748 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-18748

Vulnerability Analysis

The vulnerability lives in subsys/bluetooth/host/classic/a2dp.c. Three handlers exhibit the same bug: a2dp_process_config_ind(), bt_a2dp_get_config_cb(), and bt_a2dp_set_config_cb(). Each copies at most 8 bytes into codec_ie[] but assigns the attacker-supplied length into len, then persists the inconsistent structure into stream->codec_config on the application's struct bt_a2dp_stream.

Downstream consumers trust len without re-validating it. The AVDTP GET_CONFIGURATION responder a2dp_get_config_ind() calls net_buf_add_mem(rsp_buf, &ep->stream->codec_config.codec_ie[0], ep->stream->codec_config.len). Because codec_config is the final member of struct bt_a2dp_stream, the read crosses into memory adjacent to the stream object and transmits those bytes on-air. The same inconsistency propagates to config_req(), reconfig_req(), and get_config_rsp() application callbacks, where a natural memcpy() of len bytes performs further out-of-bounds reads.

Root Cause

The root cause is a size invariant violation. The hardcoded BT_A2DP_MAX_IE_LENGTH sized the destination buffer, but the receive path accepted and stored a longer len value instead of rejecting the oversized IE. The SBC code path incidentally pins the IE length to 4 bytes, but non-SBC endpoints have no such gate.

Attack Vector

Exploitation requires an AVDTP peer that has completed pairing, as the AVDTP L2CAP channel enforces BT_SECURITY_L2. The attacker sends a SET_CONFIGURATION carrying an oversized codec IE, then issues GET_CONFIGURATION to receive the oversized response. The net_buf tailroom check bounds the destination, so there is no out-of-bounds write. Impact is limited to disclosure of bounded adjacent RAM to the paired peer.

 #define BT_A2DP_MPEG_1_2_IE_LENGTH (4U)
 /** MPEG2,4 IE length */
 #define BT_A2DP_MPEG_2_4_IE_LENGTH (6U)
-/** The max IE (Codec Info Element) length */
-#define BT_A2DP_MAX_IE_LENGTH      (8U)

 /** @brief define the audio endpoint
  *  @param _role BT_AVDTP_SOURCE or BT_AVDTP_SINK.

Source: Zephyr patch commit c5f649f

Detection Methods for CVE-2026-18748

Indicators of Compromise

AVDTP SET_CONFIGURATION messages where the Length Of Service Capability (LOSC) field exceeds 8 bytes for non-SBC codecs.
A paired peer issuing an AVDTP GET_CONFIGURATION immediately after a SET_CONFIGURATION with an oversized codec IE.
AVDTP GET_CONFIGURATION responses carrying codec IE payloads larger than the codec's documented IE size.

Detection Strategies

Instrument the A2DP host to log any received codec IE whose declared length exceeds CONFIG_BT_A2DP_CODEC_MAX_IE_LEN.
Perform HCI trace analysis on BR/EDR links to flag AVDTP SET_CONFIGURATION service capability fields exceeding codec-specific IE lengths (4 for SBC, 4 for MPEG-1/2, 6 for MPEG-2/4).
Fuzz paired A2DP endpoints with crafted codec IE lengths and monitor for abnormal response sizes.

Monitoring Recommendations

Track AVDTP signaling anomalies on devices exposing A2DP sink or source roles.
Audit which paired devices retain BT_SECURITY_L2 and above against A2DP-enabled targets.
Correlate firmware versions in deployed fleets against the Zephyr fix commit c5f649f4.

How to Mitigate CVE-2026-18748

Immediate Actions Required

Rebuild affected Zephyr firmware with the patch from commit c5f649f4714e625362fbaa93ffd7419f9c27342b applied.
Set CONFIG_BT_A2DP_CODEC_MAX_IE_LEN to the smallest value required by the registered codecs.
Audit paired-device lists on A2DP-enabled devices and remove untrusted peers.

Patch Information

The fix replaces the hardcoded BT_A2DP_MAX_IE_LENGTH with the configurable CONFIG_BT_A2DP_CODEC_MAX_IE_LEN (default 8, range 4–253), sizes codec_ie[] from it, and rejects any received IE that exceeds the configured maximum instead of silently truncating. See the GitHub Security Advisory GHSA-6qq5-25mp-x5rg for advisory details.

Workarounds

Disable non-SBC codec endpoints (BT_A2DP_MPEG1, BT_A2DP_MPEG2, BT_A2DP_ATRAC, BT_A2DP_VENDOR) until the patch is deployed.
Disable CONFIG_BT_A2DP where A2DP functionality is not required.
Restrict BR/EDR pairing to trusted devices only to prevent attacker-controlled AVDTP peers from reaching the vulnerable code path.

bash

# Configuration example - Kconfig fragment
config BT_A2DP_CODEC_MAX_IE_LEN
	int "Maximum size of A2DP codec IE"
	default 8
	range 4 253