CVE-2025-12035 Details
Description
An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
A moderate integer overflow vulnerability has been identified in the Bluetooth Host stack of Zephyr version 4.2. This issue arises within the 'bt_br_acl_recv' routine, which is crucial for handling inbound Bluetooth Classic (BR/EDR) L2CAP traffic. The vulnerability allows remote, unauthenticated Bluetooth devices to send crafted packets that can disrupt normal operations by consuming CPU resources and bypassing flow control mechanisms. While there is no direct memory corruption, this creates a denial-of-service condition that can be particularly disruptive in resource-constrained environments.
Users are advised to validate the 'hdr->len' field before performing any arithmetic operations to prevent overflow. This vulnerability affects all BR/EDR-enabled targets running Zephyr 4.2.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 15, 2025CISA-ADP
Assessed Dec 15, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p793-3456-h7w3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zephyr | 4.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 15, 2025 | New CVE Received | [email protected] |