CVE-2026-85218

• SECURITY UPDATE: stack buffer overflow parsing a remote EIR name
  • debian/patches/CVE-2026-80186.patch: clamp the name length to HCI_MAX_NAME_LENGTH in name2utf8() in src/eir.c before copying it into the fixed-size stack buffer.
  • CVE-2026-80186
• SECURITY UPDATE: stack buffer overflow in AVRCP ListPlayerAttributes response handling
  • debian/patches/CVE-2026-85218.patch: validate the AVRCP header and params_len against the received bytes and clamp the attribute count to AVRCP_ATTRIBUTE_LAST in avrcp_list_player_attributes_rsp() in profiles/audio/avrcp.c.
  • CVE-2026-85218

• CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint codec capability storage and validate cached capabilities on load
• CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing by bounding media item and folder names to the received packet length
• CVE-2026-80185: fix type confusion crash in SDP XML record parsing by rejecting nested attributes and mismatched sequence/alternate closing elements
• CVE-2026-80186: fix stack-based buffer overflow when parsing the remote device name from EIR data
• CVE-2026-85218: fix stack-based buffer overflows in AVRCP ListPlayerAttributes response handling by validating the PDU length and clamping the attribute count

Out-of-bounds read in avrcp parse_media_element and parse_media_folder. (CVE-2026-75032) Unprivileged-local and adjacent-LE-peer leads to arbitrary code execution as root. (CVE-2026-80185) Stack Overflow in name2utf8 causes DoS and potential code execution. (CVE-2026-80186) AVRCP ListPlayerAttributes Double Stack Overflow. (CVE-2026-85218)

[Unknown description]

Michael Bommarito discovered that BlueZ incorrectly handled codec capability storage in the A2DP profile. An attacker could possibly use this issue to cause a stack buffer overflow, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-19774)

It was discovered that BlueZ incorrectly handled packet length validation. An attacker could possibly use this issue to read out of bounds memory, causing a crash or exposing sensitive information. (CVE-2026-75032)

It was discovered that BlueZ incorrectly handled crafted XML input. An attacker could possibly use this issue to crash BlueZ, resulting in a denial of service. (CVE-2026-80185)

It was discovered that BlueZ incorrectly parsed remote names from Extended Inquiry Response data. An attacker could possibly use this issue to cause a stack buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-80186)

Alexandro Calo discovered that BlueZ incorrectly parsed certain responses in the AVRCP profile. An attacker could possibly use this issue to access out of bounds memory, causing a crash or exposing sensitive information. (CVE-2026-85218)