CVE-2026-12236 | Zephyr Project up to 4.4.1 GATT Client gatt.c parse_read_std_char_desc len infinite loop

August 13, 2026 Yanac

A vulnerability was found in Zephyr Project Zephyr up to 4.4.1. It has been declared as critical. Affected is the function parse_read_std_char_desc of the file subsys/bluetooth/host/gatt.c of the component GATT Client. Such manipulation of the argument len leads to infinite loop.

This vulnerability is documented as CVE-2026-12236. The attack can be executed remotely. There is not any exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More