Description
An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zephyrproject-rtos | Zephyr | — | — |
Medium · 6.5
CVE-2025-12035
EUVD-2025-203444
Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP
Published Dec 15, 2025 · Updated Oct 13, 2026 · Assigned by zephyr