CVE-2026-19570: Bluetooth LE Audio Broadcast Sink RCE Vulnerability

CVE-2026-19570 Overview

CVE-2026-19570 is a buffer overflow vulnerability [CWE-120] in the Zephyr RTOS Bluetooth LE Audio Broadcast Sink implementation. The flaw resides in subsys/bluetooth/audio/bap_broadcast_sink.c, where subgroup metadata from a received Basic Audio Announcement (BASE) is copied into the static mod_src_param structure without bounds checks. An attacker within Bluetooth radio range can send a crafted BASE through periodic advertising to overflow a fixed static object in .bss memory. Exploitation requires no pairing, bonding, or GATT connection, and may lead to remote code execution in the Bluetooth RX thread or disclosure of adjacent memory via BASS receive-state notifications.

Critical Impact

Unauthenticated attackers in Bluetooth range can corrupt adjacent memory on broadcast sink devices, potentially achieving remote code execution without any user interaction or prior pairing.

Affected Products

• Zephyr RTOS builds with CONFIG_BT_BAP_BROADCAST_SINK enabled
• Devices using the LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c
• Any Zephyr-based firmware acting as a Bluetooth Audio Scan Service (BASS) delegator

Discovery Timeline

• 2026-10-09 - CVE-2026-19570 published to NVD
• 2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-19570

Vulnerability Analysis

The vulnerability affects the Basic Audio Profile (BAP) Broadcast Sink role in Zephyr's Bluetooth stack. When a sink device synchronizes to a periodic advertising train, it parses the BASE structure describing the broadcast's subgroups and codec metadata. The parser base_subgroup_meta_cb() writes each subgroup entry into mod_src_param.subgroups[mod_src_param.num_subgroups] without comparing num_subgroups to ARRAY_SIZE(mod_src_param.subgroups).

The destination array is sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS with a default of 1, and the per-subgroup metadata buffer is sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE with a default of 4 bytes. The BASE validator bt_bap_base_get_base_from_ad() only enforces structural consistency and permits up to roughly 24 subgroups with metadata Length-Type-Value (LTV) fields of around 240 octets. Writes extend past the static object in .bss into adjacent Bluetooth audio state.

Root Cause

The root cause is missing bounds validation on two independent fields. First, num_subgroups is incremented without checking array capacity. Second, memcpy() uses the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() without comparing against the destination metadata buffer size. The unvalidated metadata_len is also forwarded to bt_bap_scan_delegator_mod_src(), which neither clamps nor rejects it.

Attack Vector

An attacker operating a rogue broadcast source within radio range can advertise a BASE the target device syncs to. Alternatively, the attacker can impersonate the advertiser address and Set ID (SID) of an existing source, because periodic advertising data is unauthenticated. Each new BASE is re-parsed through the chain pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). A crafted BASE writes attacker-chosen bytes up to approximately 236 bytes past the metadata buffer, plus full struct bt_bap_bass_subgroup records for each excess subgroup.

// Security patch - subsys/bluetooth/audio/bap_broadcast_sink.c
	ARG_UNUSED(user_data);

+	if (mod_src_param.num_subgroups == ARRAY_SIZE(mod_src_param.subgroups)) {
+		return false;
+	}
+
+	subgroup_param = &mod_src_param.subgroups[mod_src_param.num_subgroups];
+
 	ret = bt_bap_base_get_subgroup_codec_meta(subgroup, &meta);
 	if (ret < 0) {
 		return false;
 	}

-	subgroup_param = &mod_src_param.subgroups[mod_src_param.num_subgroups];
+	if (ret <= sizeof(subgroup_param->metadata)) {
+		subgroup_param->metadata_len = (uint8_t)ret;
+		(void)memcpy(subgroup_param->metadata, meta, subgroup_param->metadata_len);
+	} else {
+		subgroup_param->metadata_len = 0U;
+	}
+
 	mod_src_param.num_subgroups++;
-	subgroup_param->metadata_len = (uint8_t)ret;
-	memcpy(subgroup_param->metadata, meta, subgroup_param->metadata_len);
// Source: Zephyr commit 5738f61f4128bb38508bab57342b1f7bf218d127

The patch rejects BASE updates carrying more subgroups than the receive state can hold and omits metadata that does not fit. It also honors the previously ignored error return of the subgroup decode pass.

Detection Methods for CVE-2026-19570

Indicators of Compromise

• Unexpected device resets, hangs, or firmware crashes on Zephyr-based Bluetooth audio devices following periodic advertising sync events
• BASS receive-state notifications containing unusual metadata payloads sent to connected Broadcast Assistants
• Repeated periodic advertising syncs to broadcast sources with anomalous advertiser addresses or SIDs

Detection Strategies

• Monitor Bluetooth stack logs for parsing errors, assertion failures, or memory faults in the BAP broadcast sink path
• Capture over-the-air Bluetooth traffic to identify BASE structures exceeding CONFIG_BT_BAP_BASS_MAX_SUBGROUPS or carrying metadata LTVs larger than CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE
• Review firmware telemetry for crashes in the Bluetooth RX thread correlated with periodic advertising reception

Monitoring Recommendations

• Deploy Bluetooth protocol analyzers near production LE Audio devices to flag malformed BASE announcements
• Instrument Zephyr builds with stack and heap canaries to catch overflows in .bss-resident BAP structures
• Alert on unexpected changes in advertiser identity for sources a device has synced to

How to Mitigate CVE-2026-19570

Immediate Actions Required

• Apply the upstream Zephyr patch from commit 5738f61f4128bb38508bab57342b1f7bf218d127 to all affected firmware images
• Rebuild and redistribute firmware for any device shipping with CONFIG_BT_BAP_BROADCAST_SINK enabled
• Audit device fleets to identify builds exposing the LE Audio Broadcast Sink role

Patch Information

The fix is published in the Zephyr project repository. See the GitHub Commit Details and the GitHub Security Advisory GHSA-4qwc-2qfq-w2fj. The patch adds a capacity check against ARRAY_SIZE(mod_src_param.subgroups), compares the decoded metadata length against sizeof(subgroup_param->metadata) before copying, and honors the error return from the subgroup decode pass.

Workarounds

• Disable CONFIG_BT_BAP_BROADCAST_SINK in device builds where the LE Audio Broadcast Sink role is not required
• Restrict device operation to physically controlled Bluetooth environments until patched firmware is deployed
• Reduce exposure by limiting periodic advertising sync to known, validated broadcast sources at the application layer

# Verify Zephyr source includes the fix
cd zephyr
git log --oneline subsys/bluetooth/audio/bap_broadcast_sink.c | grep 5738f61f

# Disable Broadcast Sink role in prj.conf if not required
# CONFIG_BT_BAP_BROADCAST_SINK=n