CVE-2026-75032
Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- Record
CVE-2026-75032- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-06
EUVDEUVD-2026-60941
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- Record
EUVD-2026-60941- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-7wfr-vqp9-gqc3
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems...
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- Record
GHSA-7wfr-vqp9-gqc3- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- Record
CVE-2026-75032- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-75032
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- Record
DEBIAN-CVE-2026-75032- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-06
OSVOESA-2026-3528
bluez security update
This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.
Security Fix(es):
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.(CVE-2026-75032)
- Record
OESA-2026-3528- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2026-75032
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- Record
UBUNTU-CVE-2026-75032- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVAZL-96861 No score
CVE-2026-75032 affecting package bluez for versions less than 5.63-7
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- Record
AZL-96861- Updated
- 2026-11-05
OSVCLSA-2026-1792508765 No score
bluez: Fix of 5 CVEs
- CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint codec capability storage and validate cached capabilities on load
- CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing by bounding media item and folder names to the received packet length
- CVE-2026-80185: fix type confusion crash in SDP XML record parsing by rejecting nested attributes and mismatched sequence/alternate closing elements
- CVE-2026-80186: fix stack-based buffer overflow when parsing the remote device name from EIR data
- CVE-2026-85218: fix stack-based buffer overflows in AVRCP ListPlayerAttributes response handling by validating the PDU length and clamping the attribute count
- Record
CLSA-2026-1792508765- Updated
- 2026-11-02
OSVMGASA-2026-0538 No score
Updated bluez package fixes security vulnerabilities
Out-of-bounds read in avrcp parse_media_element and parse_media_folder. (CVE-2026-75032) Unprivileged-local and adjacent-LE-peer leads to arbitrary code execution as root. (CVE-2026-80185) Stack Overflow in name2utf8 causes DoS and potential code execution. (CVE-2026-80186) AVRCP ListPlayerAttributes Double Stack Overflow. (CVE-2026-85218)
- Record
MGASA-2026-0538- Updated
- 2026-11-02
OSVUSN-8908-1 No score
bluez vulnerabilities
Michael Bommarito discovered that BlueZ incorrectly handled codec capability storage in the A2DP profile. An attacker could possibly use this issue to cause a stack buffer overflow, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-19774)
It was discovered that BlueZ incorrectly handled packet length validation. An attacker could possibly use this issue to read out of bounds memory, causing a crash or exposing sensitive information. (CVE-2026-75032)
It was discovered that BlueZ incorrectly handled crafted XML input. An attacker could possibly use this issue to crash BlueZ, resulting in a denial of service. (CVE-2026-80185)
It was discovered that BlueZ incorrectly parsed remote names from Extended Inquiry Response data. An attacker could possibly use this issue to cause a stack buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-80186)
Alexandro Calo discovered that BlueZ incorrectly parsed certain responses in the AVRCP profile. An attacker could possibly use this issue to access out of bounds memory, causing a crash or exposing sensitive information. (CVE-2026-85218)
- Record
USN-8908-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bluezAzure Linux:3 |
before 5.63-7 | 5.63-7 |
bluezTuxCare:AlmaLinux:9.2 From an advisory covering 5 CVEs |
before 5.72-4.el9.tuxcare.els2 | 5.72-4.el9.tuxcare.els2 |
bluez-cupsTuxCare:AlmaLinux:9.2 From an advisory covering 5 CVEs |
before 5.72-4.el9.tuxcare.els2 | 5.72-4.el9.tuxcare.els2 |
bluez-hid2hciTuxCare:AlmaLinux:9.2 From an advisory covering 5 CVEs |
before 5.72-4.el9.tuxcare.els2 | 5.72-4.el9.tuxcare.els2 |
bluez-libsTuxCare:AlmaLinux:9.2 From an advisory covering 5 CVEs |
before 5.72-4.el9.tuxcare.els2 | 5.72-4.el9.tuxcare.els2 |
bluez-libs-develTuxCare:AlmaLinux:9.2 From an advisory covering 5 CVEs |
before 5.72-4.el9.tuxcare.els2 | 5.72-4.el9.tuxcare.els2 |
bluez-meshTuxCare:AlmaLinux:9.2 From an advisory covering 5 CVEs |
before 5.72-4.el9.tuxcare.els2 | 5.72-4.el9.tuxcare.els2 |
bluez-obexdTuxCare:AlmaLinux:9.2 From an advisory covering 5 CVEs |
before 5.72-4.el9.tuxcare.els2 | 5.72-4.el9.tuxcare.els2 |
bluezDebian:12 |
All versions, plus listed versions 5.66-15.66-1+deb12u15.66-1+deb12u25.68-15.68-2 Show 24 moreShow less5.69-15.70-15.70-1.15.70-1.1~exp05.71-15.73-15.73-1.15.77-15.79-15.79-25.82-15.82-1.15.83-15.83-1~exp15.84-15.85-15.85-25.85-35.85-45.87-15.87-25.87-35.87-45.87-5 |
None known |
bluezDebian:13 |
All versions, plus listed versions 5.82-1.15.83-15.83-1~exp15.84-15.85-1 Show 8 moreShow less5.85-25.85-35.85-45.87-15.87-25.87-35.87-45.87-5 |
None known |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bluezDebian:14 |
before 5.87-2, plus listed versions 5.82-1.15.83-15.83-1~exp15.84-15.85-1 Show 4 moreShow less5.85-25.85-35.85-45.87-1 |
5.87-2 |
bluezMageia:10 From an advisory covering 4 CVEs |
before 5.87-1.1.mga10 | 5.87-1.1.mga10 |
bluezopenEuler:24.03-LTS-SP4 |
before 5.71-6.oe2403sp4 | 5.71-6.oe2403sp4 |
bluezopenEuler:20.03-LTS-SP4 |
before 5.54-17.oe2003sp4 | 5.54-17.oe2003sp4 |
bluezopenEuler:22.03-LTS-SP4 |
before 5.54-22.oe2203sp4 | 5.54-22.oe2203sp4 |
bluezopenEuler:24.03-LTS-SP1 |
before 5.71-6.oe2403sp1 | 5.71-6.oe2403sp1 |
bluezopenEuler:24.03-LTS-SP3 |
before 5.71-6.oe2403sp3 | 5.71-6.oe2403sp3 |
bluezUbuntu:Pro:16.04:LTS |
before 5.37-0ubuntu5.3+esm6, plus listed versions 5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.3 Show 5 moreShow less5.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm25.37-0ubuntu5.3+esm35.37-0ubuntu5.3+esm45.37-0ubuntu5.3+esm5 |
5.37-0ubuntu5.3+esm6 |
bluezUbuntu:Pro:18.04:LTS |
before 5.48-0ubuntu3.9+esm3, plus listed versions 5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2 Show 9 moreShow less5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.85.48-0ubuntu3.95.48-0ubuntu3.9+esm15.48-0ubuntu3.9+esm2 |
5.48-0ubuntu3.9+esm3 |
bluezUbuntu:Pro:20.04:LTS |
before 5.53-0ubuntu3.9+esm1, plus listed versions 5.50-0ubuntu45.51-0ubuntu15.51-0ubuntu25.52-0ubuntu15.52-0ubuntu2 Show 12 moreShow less5.53-0ubuntu15.53-0ubuntu25.53-0ubuntu35.53-0ubuntu3.15.53-0ubuntu3.25.53-0ubuntu3.35.53-0ubuntu3.45.53-0ubuntu3.55.53-0ubuntu3.65.53-0ubuntu3.75.53-0ubuntu3.85.53-0ubuntu3.9 |
5.53-0ubuntu3.9+esm1 |
bluezUbuntu:22.04:LTS |
before 5.64-0ubuntu1.5, plus listed versions 5.60-0ubuntu25.62-0ubuntu15.62-0ubuntu25.63-0ubuntu15.63-0ubuntu2 Show 4 moreShow less5.64-0ubuntu15.64-0ubuntu1.15.64-0ubuntu1.35.64-0ubuntu1.4 |
5.64-0ubuntu1.5 |
bluezUbuntu:24.04:LTS |
before 5.72-0ubuntu5.7, plus listed versions 5.68-0ubuntu15.70-0ubuntu15.70-0ubuntu25.70-0ubuntu35.71-0ubuntu3 Show 11 moreShow less5.71-1ubuntu25.71-1ubuntu35.72-0ubuntu15.72-0ubuntu35.72-0ubuntu45.72-0ubuntu55.72-0ubuntu5.15.72-0ubuntu5.35.72-0ubuntu5.45.72-0ubuntu5.55.72-0ubuntu5.6 |
5.72-0ubuntu5.7 |
bluezUbuntu:26.10 |
All versions, plus listed versions 5.85-45.85-4ubuntu15.87-15.87-25.87-35.87-4 |
None known |
bluezUbuntu:26.04:LTS |
before 5.85-4ubuntu0.3, plus listed versions 5.83-1~exp15.84-15.85-15.85-25.85-35.85-45.85-4ubuntu0.15.85-4ubuntu0.2 |
5.85-4ubuntu0.3 |
bluezUbuntu:Pro:16.04:LTS From an advisory covering 5 CVEs |
before 5.37-0ubuntu5.3+esm6, plus listed versions 5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.3 Show 5 moreShow less5.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm25.37-0ubuntu5.3+esm35.37-0ubuntu5.3+esm45.37-0ubuntu5.3+esm5 |
5.37-0ubuntu5.3+esm6 |
bluezUbuntu:Pro:18.04:LTS From an advisory covering 5 CVEs |
before 5.48-0ubuntu3.9+esm3, plus listed versions 5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2 Show 9 moreShow less5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.85.48-0ubuntu3.95.48-0ubuntu3.9+esm15.48-0ubuntu3.9+esm2 |
5.48-0ubuntu3.9+esm3 |
bluezUbuntu:Pro:20.04:LTS From an advisory covering 5 CVEs |
before 5.53-0ubuntu3.9+esm1, plus listed versions 5.50-0ubuntu45.51-0ubuntu15.51-0ubuntu25.52-0ubuntu15.52-0ubuntu2 Show 12 moreShow less5.53-0ubuntu15.53-0ubuntu25.53-0ubuntu35.53-0ubuntu3.15.53-0ubuntu3.25.53-0ubuntu3.35.53-0ubuntu3.45.53-0ubuntu3.55.53-0ubuntu3.65.53-0ubuntu3.75.53-0ubuntu3.85.53-0ubuntu3.9 |
5.53-0ubuntu3.9+esm1 |
bluezUbuntu:22.04:LTS From an advisory covering 5 CVEs |
before 5.64-0ubuntu1.5, plus listed versions 5.60-0ubuntu25.62-0ubuntu15.62-0ubuntu25.63-0ubuntu15.63-0ubuntu2 Show 4 moreShow less5.64-0ubuntu15.64-0ubuntu1.15.64-0ubuntu1.35.64-0ubuntu1.4 |
5.64-0ubuntu1.5 |
bluezUbuntu:24.04:LTS From an advisory covering 5 CVEs |
before 5.72-0ubuntu5.7, plus listed versions 5.68-0ubuntu15.70-0ubuntu15.70-0ubuntu25.70-0ubuntu35.71-0ubuntu3 Show 11 moreShow less5.71-1ubuntu25.71-1ubuntu35.72-0ubuntu15.72-0ubuntu35.72-0ubuntu45.72-0ubuntu55.72-0ubuntu5.15.72-0ubuntu5.35.72-0ubuntu5.45.72-0ubuntu5.55.72-0ubuntu5.6 |
5.72-0ubuntu5.7 |
bluezUbuntu:26.04:LTS From an advisory covering 5 CVEs |
before 5.85-4ubuntu0.3, plus listed versions 5.83-1~exp15.84-15.85-15.85-25.85-35.85-45.85-4ubuntu0.15.85-4ubuntu0.2 |
5.85-4ubuntu0.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | CVE List, EUVD, NVD | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-75032 is a medium vulnerability (CVSS 6.3) in Red Hat Enterprise Linux 10, published August 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in bluez 5.63-7.
References
access.redhat.com/security/cve/CVE-2026-75032
bugzilla.redhat.com/show_bug.cgi?id=2517490
nvd.nist.gov/vuln/detail/CVE-2026-75032
github.com/advisories/GHSA-7wfr-vqp9-gqc3
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792508765.html
Show 21 moreShow less
security-tracker.debian.org/tracker/CVE-2026-75032
advisories.mageia.org/MGASA-2026-0538.html
bugs.mageia.org/show_bug.cgi?id=36192
lists.fedoraproject.org/archives/list/[email protected]/message/IEAQGME7YHJPXMGE233SURK752QRXULJ
ubuntu.com/security/notices/USN-8908-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3528
cve.org/CVERecord?id=CVE-2026-75032