Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV A L N N U H H H 8.8 .0045 37.7 —
AFFECTED Product Versions Fixed Zephyr 1.14.0 – —
TIMELINE Mar 27 Reserved by zephyr Jun 9 EXPLOIT PUBLISHED — CVE-2026-5068 (zephyrproject-rtos Zephyr). Public exploit reference added. Jun 9 Published (CNA: zephyr)
A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE CoC SDU reassembly. When the application enables segmentation (via chan_ops.alloc_buf) and the chosen RX pool has a user_data_size smaller than 2 bytes, the segmentation counter stored in the net_buf user_data area is written out of bounds in l2cap_chan_le_recv_seg (subsys/bluetooth/host/l2cap.c). The observed effects are an AddressSanitizer abort and, without ASan, heap corruption / fatal error.
| Date | Event | Detail |
|---|---|---|
| March 27, 2026 | Reserved | Reserved by zephyr |
| June 9, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-5068 (zephyrproject-rtos Zephyr). Public exploit reference added. |
| June 9, 2026 | Published | Published (CNA: zephyr) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| zephyrproject-rtos | Zephyr | — | 1.14.0 | — |
Authoritative record: CVE-2026-5068 at cve.org
Vendors: zephyrproject-rtos
Weaknesses: CWE-787
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-5068 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.