CVE-2026-5706

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may be impacted.

  • Published Aug 28, 2026
  • CVSS 8.9 high
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-5706 at the National Vulnerability Database