{"id":"CVE-2026-105460","aliases":["BELL-CVE-2026-105460","DEBIAN-CVE-2026-105460","EUVD-2026-98739","GHSA-hqj4-7q22-2hmj","UBUNTU-CVE-2026-105460"],"status":"published","title":"Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()","description":"A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00118,"percentile":0.01728,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-10-13T15:12:19Z","modified":"2026-11-09T14:00:07Z","fixes":[{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.88-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.66-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.82-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.66-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.66-1","5.66-1+deb12u1","5.66-1+deb12u2","5.68-1","5.68-2","5.69-1","5.70-1","5.70-1.1","5.70-1.1~exp0","5.71-1","5.73-1","5.73-1.1","5.77-1","5.79-1","5.79-2","5.82-1","5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4","5.87-5","5.88-1"]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4","5.87-5","5.88-1"]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.88-1"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4","5.87-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4","5.37-0ubuntu5.3+esm5","5.37-0ubuntu5.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1","5.48-0ubuntu3.9+esm2","5.48-0ubuntu3.9+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9","5.53-0ubuntu3.9+esm1","5.53-0ubuntu3.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4","5.64-0ubuntu1.5","5.64-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6","5.72-0ubuntu5.7","5.72-0ubuntu5.8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.85-4","5.85-4ubuntu1","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2","5.85-4ubuntu0.3","5.85-4ubuntu0.4"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-105460","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2545923","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://redhat.atlassian.net/browse/PSIRTSUPT-24932","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105460"},{"url":"https://github.com/advisories/GHSA-hqj4-7q22-2hmj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-105460","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105460","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-105460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105460","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-105460","title":"Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()","description":"A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.","status":"published","published":"2026-10-13T15:12:19.969Z","modified":"2026-11-06T17:45:17.223Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T18:59:07.714367Z"}],"euvd":[{"id":"EUVD-2026-98739","description":"A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.","status":"published","published":"2026-10-13T15:12:19Z","modified":"2026-11-06T17:45:17Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T19:05:53.354277Z"}],"ghsa":[{"id":"GHSA-hqj4-7q22-2hmj","title":"A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth...","description":"A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.","status":"published","published":"2026-10-13T18:30:51Z","modified":"2026-10-13T18:30:58Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:13:12.080152Z"}],"nvd":[{"id":"CVE-2026-105460","description":"A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.","status":"published","published":"2026-10-13T16:17:11.87Z","modified":"2026-11-06T18:17:40.247Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T20:01:13.883836Z"}],"osv":[{"id":"BELL-CVE-2026-105460","status":"published","published":"2026-10-14T06:06:06.973857Z","modified":"2026-10-17T07:15:03.380366319Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-105460","description":"A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.","status":"published","published":"2026-10-13T16:17:11.87Z","modified":"2026-11-09T14:00:07.672496714Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-09T14:31:39.434822Z"},{"id":"UBUNTU-CVE-2026-105460","description":"A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.","status":"published","published":"2026-10-13T16:17:00Z","modified":"2026-10-17T12:59:47.919726009Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:59.130573Z"}]}}