Vulnerability Description
A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zephyrproject | Zephyr | <= 4.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hcc8-3qr7-PatchVendor Advisory
FAQ
What is CVE-2025-10456?
CVE-2025-10456 is a vulnerability with a CVSS score of 7.1 (HIGH). A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the d...
How severe is CVE-2025-10456?
CVE-2025-10456 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-10456?
Check the references section above for vendor advisories and patch information. Affected products include: Zephyrproject Zephyr.