A use-after-free vulnerability in the Zephyr RTOS Bluetooth stack allows adjacent attackers to trigger memory corruption or system crashes.

A use-after-free vulnerability (CWE-416) exists in the gatt_write_ccc_rsp() function within the Bluetooth host subsystem. An attacker within Bluetooth range can trigger this condition by sending a malformed GATT response, causing the system to interact with freed memory.

The vulnerability poses a risk of system instability, denial of service, or potentially arbitrary code execution on devices running the Zephyr RTOS. Given the nature of embedded systems, this could lead to the total loss of control over connected IoT devices or the compromise of local Bluetooth communications. The CVSS score of 7.6 highlights the urgency of addressing this flaw in connected product ecosystems.

Immediate Action: Update the Zephyr RTOS project to version 4.5.0 or later.

Proactive Monitoring: Monitor Bluetooth traffic for unexpected or malformed GATT responses that deviate from standard protocol specifications.

Compensating Controls: Disable Bluetooth functionality if it is not required for the device's operational use case to mitigate the attack vector entirely.

Public Exploit Available: No

Developers and manufacturers utilizing Zephyr RTOS must integrate the provided security patch immediately. Ensuring the Bluetooth stack is updated is critical for the security of all deployed Zephyr-based hardware.