CVE-2026-5706: Bluetooth Mesh SDK RCE Vulnerability

CVE-2026-5706 Overview

CVE-2026-5706 is an out-of-bounds write vulnerability in Silicon Labs Bluetooth Mesh SDK versions 6.1.4 and earlier. Malformed extended advertisements can trigger stack corruption and remote code execution on affected provisioner devices. Exploitation requires the attacker to control a device that has already joined the Bluetooth Mesh network. Only provisioners with extended advertisement support are impacted. The flaw is tracked under CWE-130: Improper Handling of Length Parameter Inconsistency.

Critical Impact
A joined mesh node can send crafted extended advertisements to corrupt the provisioner stack and execute arbitrary code over the adjacent Bluetooth radio range.

Affected Products

Silicon Labs Bluetooth Mesh SDK versions 6.1.4 and earlier
Provisioners built on the Gecko SDK that enable extended advertisement support
Mesh network devices operating in provisioner roles using vulnerable SDK builds

Discovery Timeline

2026-08-28 - CVE-2026-5706 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-5706

Vulnerability Analysis

The vulnerability resides in how the Bluetooth Mesh SDK parses extended advertisement payloads. Extended advertisements permit larger payloads than legacy Bluetooth Low Energy (BLE) advertisements. The SDK fails to correctly reconcile length parameters embedded in these payloads against the destination buffer size.

When a malformed extended advertisement is processed, the parser writes beyond the bounds of a stack buffer. This out-of-bounds write corrupts adjacent stack memory, including saved return addresses and control-flow data. An attacker who has already provisioned a device into the mesh network can craft payloads to overwrite these values.

Remote code execution follows once the corrupted stack frame is unwound. The compromised provisioner then runs attacker-controlled instructions with the privileges of the mesh stack, which typically has full radio and device control.

Root Cause

The root cause is improper handling of the length parameter in extended advertisement processing, classified as [CWE-130]. The SDK trusts a length field from the advertisement packet without validating it against the fixed-size receive buffer. This produces a classic length-parameter inconsistency that permits stack corruption.

Attack Vector

Exploitation requires adjacent network access over Bluetooth radio and a device already joined to the target mesh network. The attacker sends malformed extended advertisement packets from the joined node to a provisioner that supports extended advertisements. No user interaction on the provisioner is required. See the Silicon Labs Gecko SDK releases for affected component details.

Detection Methods for CVE-2026-5706

Indicators of Compromise

Unexpected resets, faults, or hard faults on Bluetooth Mesh provisioner devices
Provisioner firmware executing code paths inconsistent with normal mesh operations
Anomalous extended advertisement traffic originating from previously well-behaved mesh nodes

Detection Strategies

Capture Bluetooth radio traffic with a sniffer and inspect extended advertisement length fields for values inconsistent with payload size
Enable stack canaries and fault handlers in provisioner firmware to catch corruption at the moment of overwrite
Correlate provisioner crash logs with recent advertisement activity from specific mesh node addresses

Monitoring Recommendations

Log all provisioning events and track which nodes send extended advertisements to the provisioner
Alert on repeated malformed advertisement parsing errors from the mesh stack
Monitor Gecko SDK version inventories across deployed devices to flag builds at or below 6.1.4

How to Mitigate CVE-2026-5706

Immediate Actions Required

Inventory all Bluetooth Mesh provisioner devices and identify those running Bluetooth Mesh SDK 6.1.4 or earlier
Update affected firmware to a fixed SDK release published on the Silicon Labs Gecko SDK releases page
Review mesh node membership and remove any devices that cannot be attested as trusted

Patch Information

Silicon Labs publishes updated Gecko SDK builds that address CVE-2026-5706. Consult the GitHub Gecko SDK Releases and the Silicon Labs security document for the specific fixed version and release notes. Rebuild and reflash provisioner firmware against the patched SDK.

Workarounds

Disable extended advertisement support on provisioners where the feature is not required by the deployment
Restrict provisioning to trusted devices and rotate network keys to evict untrusted nodes
Physically isolate provisioners from untrusted radio environments until patched firmware is deployed

bash

# Verify deployed Gecko SDK version before and after patching
grep -R "GECKO_SDK_VERSION" ./firmware/src | head -n 5