Every CVE Search/ Get API key

CVE-2023-44431

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability

7.1 HighFix available

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.56%Up 1.5 points since May 3, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.1

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

Record
CVE-2023-44431
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2023-48771 7.1

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

Record
EUVD-2023-48771
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-crgw-4rjj-j4j9 7.1

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This...

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

Record
GHSA-crgw-4rjj-j4j9
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
NVD 8.0

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

Record
CVE-2023-44431
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
OSVBELL-CVE-2023-44431 8.0
Record
BELL-CVE-2023-44431
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.1

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.

The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

Record
CVE-2023-44431
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2023-44431 8.0

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

Record
DEBIAN-CVE-2023-44431
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:9413 7.1

Red Hat Security Advisory: bluez security update

Record
RHSA-2024:9413
CVSS 3.1
7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2023-44431 8.0

CVE-2023-44431 in bluez - Patched by Root

Root has patched CVE-2023-44431 in the bluez package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2023-44431
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2023-44431 8.0

CVE-2023-44431 in bluez - Patched by Root

Root has patched CVE-2023-44431 in the bluez package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2023-44431
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-44431 8.0

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19909.

Record
UBUNTU-CVE-2023-44431
CVSS 3.1
8.0 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
7.1 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2024:9413 No score

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.

Security Fix(es):

  • bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)
  • BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)
  • bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)
  • bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)
  • bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)
  • bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)
  • bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:9413
Updated
2026-11-02
OSVCLSA-2025-1763031616 No score

bluez: Fix of 10 CVEs

  • CVE-2023-27349: fix crash while handling unsupported events in avrcp
  • CVE-2023-44431: fix Stack-based buffer overflow and remote code execution vulnerability
  • CVE-2023-45866: restrict HID connections to avoid unauthorized input injection
  • CVE-2023-50229: fix heap-based buffer overflow vulnerability in handling Phone Book Access profile by adding proper validation of user-supplied data length before copying to buffer
  • CVE-2023-50230: fix heap-based buffer overflow vulnerability in Phone Book Access profile to prevent arbitrary code execution by validating user-supplied data length before copying to buffer
  • CVE-2023-51580: validate AVRCP attribute list data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51589: validate AVRCP media element data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51592: validate AVRCP media folder data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51594: validate OBEX protocol parameters to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51596: validate PBAP data length to prevent heap overflow and remote code execution
Record
CLSA-2025-1763031616
Updated
2026-11-02
OSVMGASA-2025-0115 No score

Updated bluez packages fix security vulnerabilities

BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2023-44431) BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. (CVE-2023-51580) BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. (CVE-2023-51589) BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. (CVE-2023-51592) BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. (CVE-2023-51594) BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2023-51596)

Record
MGASA-2025-0115
Updated
2026-11-02
OSVRLSA-2024:9413 No score

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files.

Security Fix(es):

  • bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)

  • BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)

  • bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)

  • bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)

  • bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)

  • bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)

  • bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

Record
RLSA-2024:9413
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bluez
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-cups
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-libs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-libs-devel
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-obexd
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez
Alpaquita:23
 5.66-r1 and later None known
bluez
Alpaquita:stream
 5.66-r2 and later None known
bluez
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-cups
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-hid2hci
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
Show 50 moreShow less
Affected packages
PackageAffectedFixed
bluez-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-libs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-mesh
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-obexd
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez
Debian:12
 All versions, plus listed versions
5.66-15.66-1+deb12u15.66-1+deb12u25.68-15.68-2
Show 24 moreShow less
5.69-15.70-15.70-1.15.70-1.1~exp05.71-15.73-15.73-1.15.77-15.79-15.79-25.82-15.82-1.15.83-15.83-1~exp15.84-15.85-15.85-25.85-35.85-45.87-15.87-25.87-35.87-45.87-5
 None known
bluez
Debian:13
 All versions, plus listed versions
5.82-1.15.83-15.83-1~exp15.84-15.85-1
Show 8 moreShow less
5.85-25.85-35.85-45.87-15.87-25.87-35.87-45.87-5
 None known
bluez
Debian:14
 All versions, plus listed versions
5.82-1.15.83-15.83-1~exp15.84-15.85-1
Show 8 moreShow less
5.85-25.85-35.85-45.87-15.87-25.87-35.87-45.87-5
 None known
bluez
Mageia:9
From an advisory covering 6 CVEs
 before 5.80-1.mga9
5.80-1.mga9
bluez-cups
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez
Rocky Linux:9
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez
Root:Debian:11
 before 5.55-3.1+deb11u2.root.io.5
5.55-3.1+deb11u2.root.io.55.55-3.1+deb11u2.root.io.15.55-3.1+deb11u2.root.io.25.55-3.1+deb11u2.root.io.35.55-3.1+deb11u2.root.io.45.55-3.1+deb11u2.aikido.65.55-3.1+deb11u2.aikido.7
rootio-bluez
Root:Debian:11
 before 5.55-3.1+deb11u2.root.io.5
5.55-3.1+deb11u2.root.io.55.55-3.1+deb11u2.root.io.15.55-3.1+deb11u2.root.io.25.55-3.1+deb11u2.root.io.35.55-3.1+deb11u2.root.io.45.55-3.1+deb11u2.aikido.65.55-3.1+deb11u2.aikido.7
bluez
Root:Debian:12
 before 5.66-1+deb12u2.root.io.10
5.66-1+deb12u2.root.io.105.66-1+deb12u2.root.io.145.66-1+deb12u2.root.io.165.66-1+deb12u2.root.io.75.66-1+deb12u2.root.io.85.66-1+deb12u2.root.io.95.66-1+deb12u2.root.io.135.66-1+deb12u2.root.io.115.66-1+deb12u2.root.io.125.66-1+deb12u2.root.io.155.66-1+deb12u2.aikido.175.66-1+deb12u2.aikido.185.66-1+deb12u2.aikido.19
rootio-bluez
Root:Debian:12
 before 5.66-1+deb12u2.root.io.10
5.66-1+deb12u2.root.io.105.66-1+deb12u2.root.io.145.66-1+deb12u2.root.io.165.66-1+deb12u2.root.io.75.66-1+deb12u2.root.io.85.66-1+deb12u2.root.io.95.66-1+deb12u2.root.io.135.66-1+deb12u2.root.io.115.66-1+deb12u2.root.io.125.66-1+deb12u2.root.io.155.66-1+deb12u2.aikido.175.66-1+deb12u2.aikido.185.66-1+deb12u2.aikido.19
bluez
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.3
Show 6 moreShow less
5.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm25.37-0ubuntu5.3+esm35.37-0ubuntu5.3+esm45.37-0ubuntu5.3+esm55.37-0ubuntu5.3+esm6
 None known
bluez
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2
Show 10 moreShow less
5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.85.48-0ubuntu3.95.48-0ubuntu3.9+esm15.48-0ubuntu3.9+esm25.48-0ubuntu3.9+esm3
 None known
bluez
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
5.50-0ubuntu45.51-0ubuntu15.51-0ubuntu25.52-0ubuntu15.52-0ubuntu2
Show 14 moreShow less
5.53-0ubuntu15.53-0ubuntu25.53-0ubuntu35.53-0ubuntu3.15.53-0ubuntu3.25.53-0ubuntu3.35.53-0ubuntu3.45.53-0ubuntu3.55.53-0ubuntu3.65.53-0ubuntu3.75.53-0ubuntu3.85.53-0ubuntu3.95.53-0ubuntu3.9+esm15.53-0ubuntu3.9+esm2
 None known
bluez
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.60-0ubuntu25.62-0ubuntu15.62-0ubuntu25.63-0ubuntu15.63-0ubuntu2
Show 6 moreShow less
5.64-0ubuntu15.64-0ubuntu1.15.64-0ubuntu1.35.64-0ubuntu1.45.64-0ubuntu1.55.64-0ubuntu1.6
 None known
bluez
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.68-0ubuntu15.70-0ubuntu15.70-0ubuntu25.70-0ubuntu35.71-0ubuntu3
Show 13 moreShow less
5.71-1ubuntu25.71-1ubuntu35.72-0ubuntu15.72-0ubuntu35.72-0ubuntu45.72-0ubuntu55.72-0ubuntu5.15.72-0ubuntu5.35.72-0ubuntu5.45.72-0ubuntu5.55.72-0ubuntu5.65.72-0ubuntu5.75.72-0ubuntu5.8
 None known
bluez
Ubuntu:25.10
 All versions, plus listed versions
5.79-2ubuntu15.82-15.82-1ubuntu15.83-1~exp15.83-1~exp1ubuntu0.1
 None known
bluez
Ubuntu:26.10
 All versions, plus listed versions
5.85-45.85-4ubuntu15.87-15.87-25.87-35.87-4
 None known
bluez
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.83-1~exp15.84-15.85-15.85-25.85-3
Show 5 moreShow less
5.85-45.85-4ubuntu0.15.85-4ubuntu0.25.85-4ubuntu0.35.85-4ubuntu0.4
 None known

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-44431 is a high vulnerability (CVSS 7.1) in Bluez, published May 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in bluez 5.55-3.1+deb11u2.root.io.5.

References

Show 61 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open