High severity · published Nov 21, 2023
CVE-2023-4424
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zephyr · Zephyrproject
through 3.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4424
Third Party Advisory
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j4qm-xgpf-qjw3
More from Zephyr
10.0
CVE-2023-4260
Potential off-by-one buffer overflow vulnerability in the Zephyr fuse file system
9.8
CVE-2026-13214
Stack buffer overflow in OCPP GetConfiguration key parsing
9.8
CVE-2026-10666
Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`
9.8
CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
9.8
CVE-2026-1678
dns: memory‑safety issue in the DNS name parser