Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-10456

CVE-2025-10456MEDIUM

zephyrproject-rtos Zephyr — Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   A   L   N   N  U  N  N  H    6.5   .0021   10.6     —

AFFECTED
  Product  Versions     Fixed
  Zephyr   unspecified  —

TIMELINE
  Sep 15  Reserved by zephyr
  Sep 19  Published (CNA: zephyr)
  Oct 13  RESCORED — CVE-2025-10456 (zephyrproject-rtos Zephyr). CVSS 7.1 → 6.5 (NVD).

CWE-190 · CNA: zephyr · CVSS v3.1 · 1 reference · NVD status: Analyzed

Description

A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 15, 2025	Reserved	Reserved by zephyr
September 19, 2025	Published	Published (CNA: zephyr)
October 13, 2026	RESCORED	RESCORED — CVE-2025-10456 (zephyrproject-rtos Zephyr). CVSS 7.1 → 6.5 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
zephyrproject-rtos	Zephyr	—	—	—

Weaknesses

CWE-190

References (1)

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hcc8-3qr7-c9m8 [Patch, Vendor Advisory]

Authoritative record: CVE-2025-10456 at cve.org

Vendors: zephyrproject-rtos

Weaknesses: CWE-190

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-10456 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.