CVE-2025-10456 - CVE House
Back to Database
Status published High CVE-2025-10456

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

Vulnerability Description

A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10456

Credits & Attribution

No credits recorded in the NVD database.

References

More from zephyrproject-rtos

View All →
CVE-2025-9558
Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start
High 7.6
CVE-2025-9557
Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont
High 7.6
CVE-2025-9408
Userspace privilege escalation vulnerability on Cortex M
High 8.2
CVE-2025-7403
Bluetooth: bt_conn_tx_processor unsafe handling
High 7.6
CVE-2025-2962
Infinite loop in dns_copy_qname
High 8.2

Affected Vendor

zephyrproject-rtos

View all reports →

Affected Software

Zephyr
Vulnerable Versions:
*

Timeline

Official Publish: September 19th, 2025
Last Modified: September 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

CWE-190

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact