CVE-2026-19570

Executive Summary

CVE-2026-19570 is a memory-corruption vulnerability (classic buffer overflow, CWE-120) in the Zephyr RTOS Bluetooth LE Audio Broadcast Sink implementation. The code copies attacker-controlled subgroup metadata from a received Basic Audio Announcement (BASE) into fixed-size static structures without bounds checking, allowing an out-of-bounds write. Any device built with the broadcast sink role enabled (CONFIG_BT_BAP_BROADCAST_SINK) is affected once it syncs to a malicious or impersonated periodic advertiser within radio range, with a CVSS base score of 8.8 (High) reflecting high confidentiality, integrity, and availability impact over an adjacent-network attack vector with no privileges or user interaction required. No public proof-of-concept, exploit code, or patch currently exists.

Technical Analysis

The vulnerability resides in subsys/bluetooth/audio/bap_broadcast_sink.c, within the LE Audio Broadcast Sink. When a sink device receives a Basic Audio Announcement over periodic advertising, the BASE is parsed and subgroup metadata is copied into the static Broadcast Audio Scan Service (BASS) parameter structure mod_src_param.

Two unbounded write conditions exist:

1. Subgroup index overflow. In base_subgroup_meta_cb(), the destination element is chosen as mod_src_param.subgroups[mod_src_param.num_subgroups] with no check against ARRAY_SIZE(mod_src_param.subgroups). That array is sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, which defaults to 1. The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to approximately 24 subgroups. Consequently, a crafted BASE containing more subgroups than the configured maximum writes past the end of the static subgroups array.

2. Metadata length overflow. The metadata is copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE, which defaults to 4 bytes. The validator permits metadata LTVs (length-type-value elements) of up to approximately 240 octets, so a single oversized metadata element overflows the destination buffer.

Attack surface / reachability. The path is reached from the periodic advertising receive callback: pa_recv() → bt_data_parse() → pa_decode_base() → update_recv_state_base() → bt_bap_base_foreach_subgroup() → base_subgroup_meta_cb(). Every broadcast sink registers a scan-delegator receive state at creation (bt_bap_broadcast_sink_create() calls broadcast_sink_add_src()), and CONFIG_BT_BAP_BROADCAST_SINK depends on CONFIG_BT_BAP_SCAN_DELEGATOR. Therefore the vulnerable path is active in every broadcast-sink build once the device is periodic-advertising-synced. No authentication, pairing, or user interaction is required — only Bluetooth radio adjacency and a synchronized periodic advertising train.

Because the destination structures are static and the overflow length is attacker-controlled (up to roughly 240 octets beyond a 4-byte buffer, plus array-relative overruns from up to ~24 subgroups), the write can corrupt adjacent state in the BASS parameter region. This is a straightforward out-of-bounds write primitive whose exploitability depends on the memory layout of the specific Zephyr build and the attacker's ability to shape the overrun length through the crafted BASE content.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (unbounded copy into fixed-size static structures) and the explicitly documented call path. Specific function names below are those named verbatim in the description.

1. Reconnaissance / target identification. The attacker identifies a Zephyr-based LE Audio device operating as a broadcast sink (e.g., hearing aids, earbuds, speakers, set-top/audio bridges). This can be done by observing BLE advertising and periodic advertising activity and confirming the device syncs to broadcast sources.

2. Triggering the flaw class. The attacker operates a broadcast source (or impersonates the advertiser address and SID of a legitimate source the device is already synced to) and emits a Basic Audio Announcement whose BASE is malformed in one of two ways: (a) it declares and populates more subgroups than CONFIG_BT_BAP_BASS_MAX_SUBGROUPS allows, or (b) it includes subgroup codec metadata whose on-air length exceeds CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE. Both pass the structural validator bt_bap_base_get_base_from_ad().

3. Payload / execution. When the sink's periodic advertising receive callback fires (pa_recv() → ... → base_subgroup_meta_cb()), the unbounded memcpy() writes attacker-controlled bytes past the end of mod_src_param.subgroups and/or its metadata buffer. The attacker controls both the placement (which write overruns) and the content of the overwrite.

4. Post-exploitation impact. The out-of-bounds write corrupts adjacent memory in the BASS parameter structure. Depending on build layout, this may cause a crash/denial of service (availability), corruption of BASS sync parameters that alter what the device subscribes to (integrity), or — with carefully shaped content — control of function pointers or state leading to arbitrary code execution in the Bluetooth host stack (confidentiality/integrity). CVSS rates C/I/A all High (S:U), consistent with a corruptible contiguous memory region.

Impact Assessment

• Confidentiality (C: High): Memory corruption in the audio/protocol stack can lead to disclosure of adjacent memory contents if the corrupted region controls data returned to the attacker or to upper layers.
• Integrity (I: High): The overwrite directly corrupts BASS/broadcast-sink state; attacker-controlled metadata is written beyond intended bounds, enabling state manipulation.
• Availability (A: High): An uncontrolled out-of-bounds write into static structures will very often crash or hang the device, taking the audio function offline.
• Attack vector (AV:A): Adjacent network — attacker must be within Bluetooth radio range and synced as a broadcast source.
• Complexity/privileges/user interaction: AC:L, PR:N, UI:N — no pairing, credentials, or user action required.
• Blast radius: Every Zephyr build with the broadcast sink role enabled. Because the vulnerable path is active at periodic-advertising sync, any such device within range of a malicious source is exposed. Embedded audio devices are typically hard to field-update, magnifying operational impact. No evidence of in-the-wild exploitation or CISA KEV listing at this time.

Detection Guidance

Sigma Rule

title: Suspicious Bluetooth LE Audio Broadcast Sink Metadata Overflow Attempt
id: 3f9c1a72-0b6e-4d5a-9c2f-cve202619570
status: experimental
description: Detects host-side indications of a crafted BASE / subgroup metadata handling in Zephyr BLE Audio broadcast sink (CVE-2026-19570), e.g. crash or anomalous BT audio stack events on a gateway.
logsource:
  product: linux
  service: kernel
detection:
  selection_proc:
    Image|endswith:
      - '/bluetoothd'
    Message|contains:
      - 'bap_broadcast_sink'
      - 'base_subgroup_meta'
      - 'BASS'
  selection_crash:
    Message|contains:
      - 'Bluetooth'
      - 'segfault'
  condition: selection_proc or selection_crash
fields:
  - Image
  - Message
falsepositives:
  - Normal Bluetooth stack restarts on gateways
level: medium
tags:
  - attack.t1190
  - cve.2026.19570

YARA Rule

rule CVE_2026_19570_Zephyr_BASE_Subgroup_Overflow
{
    meta:
        author = "Threat Intel"
        description = "Detects Zephyr BLE Audio broadcast sink binary with unbounded BASE subgroup metadata copy (CVE-2026-19570)"
        cve = "CVE-2026-19570"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19570"
    strings:
        $fn1 = "base_subgroup_meta_cb" ascii
        $fn2 = "bt_bap_base_get_base_from_ad" ascii
        $fn3 = "bt_bap_base_get_subgroup_codec_meta" ascii
        $file = "bap_broadcast_sink" ascii
        $cfg1 = "CONFIG_BT_BAP_BASS_MAX_SUBGROUPS" ascii
        $cfg2 = "CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE" ascii
    condition:
        ($file or any of ($fn*)) and (any of ($fn*) or any of ($cfg*))
}

Suricata IDS Rule

Note: This vulnerability occurs over BLE periodic advertising (L2CAP/link layer), which Suricata does not natively decode. The rule below provides generic detection via a Bluetooth-attached capture shim emitting BLE events to a monitored interface. It is a placeholder surface-level match, not a packet-accurate signature.

alert udp any any -> any any (msg:"CVE-2026-19570 Possible BLE LE Audio BASE Metadata Overflow (shim)"; content:"BASE"; content:"subgroup"; nocase; reference:cve,2026-19570; classtype:attempted-admin; sid:2026195701; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [ process where event.action == "start" and process.name == "bluetoothd" ]
  [ process where event.category == "process" and
      process.name == "bluetoothd" ]

Splunk SPL Query

index=bluetooth OR index=linux_logs sourcetype=syslog
("bap_broadcast_sink" OR "base_subgroup_meta_cb" OR "BASS")
| where match(_raw, "(?i)segfault|overflow|out.?of.?bounds|crash")
| stats count values(host) as affected_hosts by source
| sort - count

Wazuh OSSEC Rule

<group name="bluetooth,cve_2026_19570,">
  <rule id="100570" level="10">
    <decoded_as>syslog</decoded_as>
    <match>bap_broadcast_sink|base_subgroup_meta_cb|BASS</match>
    <description>CVE-2026-19570: Suspicious BLE Audio broadcast sink activity detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100571" level="12">
    <decoded_as>syslog</decoded_as>
    <match>bluetoothd|Bluetooth</match>
    <regex>segfault|overflow|out of bounds</regex>
    <description>CVE-2026-19570: Possible Bluetooth audio stack memory corruption</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Disable the broadcast sink role if not operationally required (CONFIG_BT_BAP_BROADCAST_SINK=n, noting it pulls in CONFIG_BT_BAP_SCAN_DELEGATOR).
   • Where the role is required, reduce the attack window by limiting the set of broadcast sources the device will sync to (SID/address allow-listing) and disabling automatic sync to unknown periodic advertisers where the BASS implementation permits.
   • Increase defense-in-depth by hardening the build: bound-checking is absent upstream, so increasing CONFIG_BT_BAP_BASS_MAX_SUBGROUPS/CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE reduces but does not eliminate the issue, since the validator permits up to ~24 subgroups and ~240-octet metadata LTVs; this is a temporary risk-reduction measure only.
   • Physically control RF proximity where feasible (BLE adjacency is required, limiting remote exposure).

2. Patch/upgrade steps

   • No vendor patch is currently available. Track the Zephyr RTOS project for an upstream fix to subsys/bluetooth/audio/bap_broadcast_sink.c and the BASE validator in bt_bap_base_get_base_from_ad().
   • Optionally apply a local source-level fix that adds bounds checks before the memcpy() in base_subgroup_meta_cb() against ARRAY_SIZE(mod_src_param.subgroups) and against the metadata array size, and, if required, synchronize with upstream before deploying.

3. Long-term hardening

   • Adopt strict bounds checking and safe copy primitives (e.g., length-checked copies) throughout all code paths that ingest over-the-air variable-length structures.
   • Treat all periodic advertising / BASE content as fully untrusted input; validate lengths before every copy.
   • Maintain an inventory of Zephyr-based wireless audio devices and integrate them into firmware vulnerability management; keep build configurations minimal to reduce vulnerable code paths.
   • Encourage upstream maintainers to allow-list or cap subgroup counts and metadata lengths at validation time rather than at copy time.

References

• NVD — CVE-2026-19570: https://nvd.nist.gov/vuln/detail/CVE-2026-19570
• Zephyr Project RTOS source, subsys/bluetooth/audio/bap_broadcast_sink.c (upstream code path); Zephyr security advisories: https://github.com/zephyrproject-rtos/zephyr/security
• CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'): https://cwe.mitre.org/data/definitions/120.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST CVSS v3.1 specification: https://www.first.org/cvss/specification-document
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-19570 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are known for CVE-2026-19570 at the time of writing. CISA KEV: NO. Public PoC: None.