What is CVE-2026-10680?

CVE-2026-10680 is a high-severity vulnerability in Zephyrproject Zephyr, classified under Out-of-bounds Read. CVSS score: 7.6/10. Published 2026-07-21.

How severe is CVE-2026-10680?

High severity. CVSS v3 base score is 7.6 out of 10.

Out-of-bounds Read in Zephyrproject Zephyr

CVE-2026-10680

The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) inste…

Vulnerability class: Buffer Overflow

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.

Affected products

Zephyrproject Zephyr — versions 4.2.0, 4.4.0

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

vulnerabilities@zephyrproject.org (patch)
vulnerabilities@zephyrproject.org

Frequently asked questions

What is CVE-2026-10680?: CVE-2026-10680 is a high-severity vulnerability in Zephyrproject Zephyr, classified under Out-of-bounds Read. CVSS score: 7.6/10. Published 2026-07-21.
How severe is CVE-2026-10680?: High severity. CVSS v3 base score is 7.6 out of 10.