CVE-2026-16473
Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
- Record
CVE-2026-16473- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-05
EUVDEUVD-2026-47623
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
- Record
EUVD-2026-47623- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-2xmm-4jcc-wgxq
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame...
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
- Record
GHSA-2xmm-4jcc-wgxq- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
- Record
CVE-2026-16473- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-05
OSVBELL-CVE-2026-16473
- Record
BELL-CVE-2026-16473- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-16473
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
- Record
DEBIAN-CVE-2026-16473- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-16473
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
- Record
UBUNTU-CVE-2026-16473- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVAZL-93096 No score
CVE-2026-16473 affecting package sbc 2.0-6
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
- Record
AZL-93096- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12113-1 No score
libsbc1-2.2-2.1 on GA media
These are all security issues fixed in the libsbc1-2.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12113-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sbcAzure Linux:3 |
through 2.0-6 | None known |
sbcAlpaquita:23 |
2.0-r0 and later | None known |
sbcAlpaquita:25 |
2.0-r2 and later | None known |
sbcAlpaquita:stream |
2.0-r2 and later | None known |
sbcDebian:12 |
All versions, plus listed versions 2.0-12.1-1 |
None known |
sbcDebian:13 |
All versions, plus listed versions 2.1-1 |
None known |
sbcDebian:14 |
All versions, plus listed versions 2.1-1 |
None known |
sbcUbuntu:16.04:LTS |
All versions, plus listed versions 1.3-1 |
None known |
sbcUbuntu:18.04:LTS |
All versions, plus listed versions 1.3-2 |
None known |
sbcUbuntu:20.04:LTS |
All versions, plus listed versions 1.4-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sbcUbuntu:22.04:LTS |
All versions, plus listed versions 1.5-3build11.5-3build2 |
None known |
sbcUbuntu:24.04:LTS |
All versions, plus listed versions 2.0-12.0-1build1 |
None known |
sbcUbuntu:26.10 |
All versions, plus listed versions 2.1-1build1 |
None known |
sbcUbuntu:26.04:LTS |
All versions, plus listed versions 2.1-12.1-1build1 |
None known |
sbcopenSUSE:Tumbleweed |
before 2.2-2.1 | 2.2-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-16473 is a medium vulnerability (CVSS 4.3) in Red Hat Enterprise Linux 10, published July 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in sbc 2.2-2.1.