# CVE-2026-9263: Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets

Status: published. Published: 2026-06-30. Updated: 2026-11-04.

The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fails to validate the length field of a framed ISO PDU start segment. Per the Bluetooth specification a start segment (sc=0) always carries a 3-byte time_offset, so its segment-header len must be at least PDU_ISO_SEG_TIMEOFFSET_SIZE (3). isoal_check_seg_header() accepted start segments with len < 3 as valid, and isoal_rx_framed_consume() then computed length = seg_hdr->len - 3 in a uint8_t, underflowing to 253-255 when len is 0-2. That oversized length is passed to isoal_rx_append_to_sdu(), whose copy is clamped only against the destination SDU buffer size, not the source PDU length, so up to ~255 bytes of controller memory beyond the received PDU are copied (via sink_sdu_write_hci()/net_buf_add_mem) into an HCI ISO data packet and delivered to the host. The PDU and its segment headers are entirely attacker-controlled and arrive over the air, reachable through both the CIS and BIS-sync HCI data paths (hci_driver.c) and the vendor data path (ull_iso.c), so a remote CIS peer or a broadcaster the device is synced to can trigger an out-of-bounds read causing information disclosure to the host and potential denial of service (faults or malformed oversized HCI ISO packets). The flaw affects all Zephyr releases since framed ISO reception was introduced in v3.0.0. The fix rejects sc=0 segments with len < 3 in isoal_check_seg_header() and adds a guard before the subtraction in isoal_rx_framed_consume().

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: zephyr) — https://github.com/zephyrproject-rtos/zephyr/commit/28080d80fc8aca30af1dfd1338bd4481b13c7395

## Affected products and versions

- zephyrproject / zephyr (zephyr): ≥ 3.3.0; < 4.3.1 (affected, semver); ≥ 4.4.0; < 4.4.1 (affected, semver). Source: CNA: zephyr

## Severity and prioritization

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; source: CNA: zephyr

- CISA KEV: No listing in collected sources

- EPSS: 0.33% as of 2026-11-03; percentile 25.87%

- SSVC: exploitation poc; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-125

## Exploit evidence

- exploit: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2 (ADP: CISA-ADP)

## References

- https://github.com/zephyrproject-rtos/zephyr/commit/28080d80fc8aca30af1dfd1338bd4481b13c7395 (CNA: zephyr; patch)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2 (CNA: zephyr)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-6gvp-pmh8-fjh2 (ADP: CISA-ADP; exploit)

## Provenance

- CNA: zephyr: https://www.cve.org/CVERecord?id=CVE-2026-9263; retrieved 2026-11-04; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-9263; retrieved 2026-11-04; source updated Not reported

Revision: 1f9256cc78f39d0ea78f4bbb9ff81a4889f63115100626f4f0dfbd839f1ad5e7

Canonical: https://y2.dev/cve/CVE-2026-9263

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.