CVE-2025-9557: Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont
Published Nov 26, 2025
·Updated
An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to a crash and a resultant denial of service.
Affected Software
1 affected component
Zephyr Project Zephyr
Event History
Nov 26, 2025
CVE Published
via MITRE·05:43 AM
Data Sourced
via MITRE·05:43 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-9557?
CVE-2025-9557 has a severity rating of 7.6, indicating a high risk.
2
What are the potential impacts of CVE-2025-9557?
CVE-2025-9557 can lead to arbitrary code execution, crashes, and denial of service on affected devices.
3
How do I fix CVE-2025-9557?
To address CVE-2025-9557, update the firmware of your Bluetooth devices to the latest version that includes patches for this vulnerability.
4
What type of devices are affected by CVE-2025-9557?
CVE-2025-9557 affects Bluetooth devices that utilize the specified mesh provisioning features.
5
What does the out-of-bound write in CVE-2025-9557 entail?
The out-of-bound write in CVE-2025-9557 allows attackers to overwrite memory regions, leading to potential exploitation and instability in affected systems.