{"id":"CVE-2026-19774","aliases":["AZL-103122","CLSA-2026-1792508765","DEBIAN-CVE-2026-19774","EUVD-2026-79131","GHSA-53cx-rp5p-x795","OESA-2026-3729","OESA-2026-3730","OESA-2026-3731","OESA-2026-3732","OESA-2026-3881","ROOT-OS-DEBIAN-12-CVE-2026-19774","ROOT-OS-DEBIAN-13-CVE-2026-19774","UBUNTU-CVE-2026-19774","USN-8908-1","USN-8908-2"],"status":"published","title":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","severity":{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00266,"percentile":0.18715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-09-14T16:33:48Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"bluez","fixed_in":["5.63-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.87-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"bluez","fixed_in":["5.66-1+deb12u2.aikido.19"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-bluez","fixed_in":["5.66-1+deb12u2.aikido.19"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"bluez","fixed_in":["5.82-1.1.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-bluez","fixed_in":["5.82-1.1.aikido.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","fixed_in":["5.53-0ubuntu3.9+esm1","5.53-0ubuntu3.9+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bluez","fixed_in":["5.64-0ubuntu1.5","5.64-0ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"bluez","fixed_in":["5.72-0ubuntu5.7","5.72-0ubuntu5.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"bluez","fixed_in":["5.85-4ubuntu0.3","5.85-4ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.63-8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-mesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.66-1","5.66-1+deb12u1","5.66-1+deb12u2","5.68-1","5.68-2","5.69-1","5.70-1","5.70-1.1","5.70-1.1~exp0","5.71-1","5.73-1","5.73-1.1","5.77-1","5.79-1","5.79-2","5.82-1","5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.87-1"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-18.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-23.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-7.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-7.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-7.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.66-1+deb12u2.aikido.19"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.66-1+deb12u2.aikido.19"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.82-1.1.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.82-1.1.aikido.8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm1"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.5"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.7"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.85-4","5.85-4ubuntu1","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.3"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm6"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4","5.37-0ubuntu5.3+esm5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm3"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1","5.48-0ubuntu3.9+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm1"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.5"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.7"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.3"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm2"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9","5.53-0ubuntu3.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.6"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4","5.64-0ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.8"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6","5.72-0ubuntu5.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.4"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2","5.85-4ubuntu0.3"]}],"products":[{"vendor":"bluez","product":"bluez"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-589/","tags":["x_research-advisory","advisory"]},{"url":"https://github.com/bluez/bluez/pull/2251","tags":["vendor-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19774","tags":["web","advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-589"},{"url":"https://github.com/advisories/GHSA-53cx-rp5p-x795"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792508765.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85218","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19774.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-19774","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3729","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3730","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3731","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3732","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3881","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-19774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19774","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8908-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-75032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85218","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8908-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2170509","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-19774","title":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","status":"published","published":"2026-09-15T18:01:53.749Z","modified":"2026-09-16T03:57:38.124Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-79131","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","status":"published","published":"2026-09-15T18:01:53Z","modified":"2026-09-16T03:57:38Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:16.649841Z"}],"ghsa":[{"id":"GHSA-53cx-rp5p-x795","title":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability...","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","status":"published","published":"2026-09-15T21:31:15Z","modified":"2026-09-15T21:31:16Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:11:55.405915Z"}],"nvd":[{"id":"CVE-2026-19774","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","status":"published","published":"2026-09-15T19:17:17.867Z","modified":"2026-09-18T19:10:46.443Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-19774","title":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","status":"published","published":"2026-09-15T18:01:53.749Z","modified":"2026-10-28T02:30:21.642408788Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"DEBIAN-CVE-2026-19774","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.  The specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","status":"published","published":"2026-09-15T19:17:17.867Z","modified":"2026-10-01T03:02:30.202425417Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"OESA-2026-3729","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, was found in Linux BlueZ (version now known).CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-14T16:33:48Z","modified":"2026-09-13T16:45:21.879795835Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3730","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, was found in Linux BlueZ (version now known).CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-14T16:33:48Z","modified":"2026-09-13T16:45:22.217967561Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3731","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, was found in Linux BlueZ (version now known).CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-14T16:33:49Z","modified":"2026-09-13T16:45:22.338702973Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3732","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, was found in Linux BlueZ (version now known).CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-14T16:33:49Z","modified":"2026-09-13T16:45:22.631565531Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3881","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nBlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-20T13:22:52Z","modified":"2026-09-20T13:30:21.896622424Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-19774","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","status":"published","published":"2026-09-15T19:17:00Z","modified":"2026-10-17T12:58:47.861684081Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"AZL-103122","title":"CVE-2026-19774 affecting package bluez for versions less than 5.63-8","description":"BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.","status":"published","published":"2026-09-15T19:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"CLSA-2026-1792508765","title":"bluez: Fix of 5 CVEs","description":"- CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint\n  codec capability storage and validate cached capabilities on load\n- CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing\n  by bounding media item and folder names to the received packet length\n- CVE-2026-80185: fix type confusion crash in SDP XML record parsing by rejecting\n  nested attributes and mismatched sequence/alternate closing elements\n- CVE-2026-80186: fix stack-based buffer overflow when parsing the remote device\n  name from EIR data\n- CVE-2026-85218: fix stack-based buffer overflows in AVRCP ListPlayerAttributes\n  response handling by validating the PDU length and clamping the attribute count","status":"published","published":"2026-10-20T15:06:18Z","modified":"2026-10-26T09:31:01.978901071Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-19774","title":"CVE-2026-19774 in bluez - Patched by Root","description":"Root has patched CVE-2026-19774 in the bluez package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-25T09:30:53Z","modified":"2026-09-25T10:15:02.872374411Z","updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-19774","title":"CVE-2026-19774 in bluez - Patched by Root","description":"Root has patched CVE-2026-19774 in the bluez package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-09-25T09:34:09Z","modified":"2026-09-25T10:15:02.871275212Z","updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"USN-8908-1","title":"bluez vulnerabilities","description":"Michael Bommarito discovered that BlueZ incorrectly handled codec\ncapability storage in the A2DP profile. An attacker could possibly\nuse this issue to cause a stack buffer overflow, resulting in a denial\nof service or arbitrary code execution. This issue only affected Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-19774)\n\nIt was discovered that BlueZ incorrectly handled packet length validation.\nAn attacker could possibly use this issue to read out of bounds memory,\ncausing a crash or exposing sensitive information. (CVE-2026-75032)\n\nIt was discovered that BlueZ incorrectly handled crafted XML input. An\nattacker could possibly use this issue to crash BlueZ, resulting in a\ndenial of service. (CVE-2026-80185)\n\nIt was discovered that BlueZ incorrectly parsed remote names from Extended\nInquiry Response data. An attacker could possibly use this issue to cause a\nstack buffer overflow, resulting in a denial of service or arbitrary code\nexecution. (CVE-2026-80186)\n\nAlexandro Calo discovered that BlueZ incorrectly parsed certain responses\nin the AVRCP profile. An attacker could possibly use this issue to access\nout of bounds memory, causing a crash or exposing sensitive information.\n(CVE-2026-85218)","status":"published","published":"2026-10-08T21:50:08Z","modified":"2026-10-09T19:41:59.910110322Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8908-2","title":"bluez regression","description":"USN-8908-1 fixed vulnerabilities in BlueZ. Unfortunately, that update introduced a\nregression in the A2DP profile: cached remote stream endpoints were no\nlonger loaded at startup, which could cause Bluetooth audio devices to\nfail to reconnect automatically or to fall back to low-quality audio\nprofiles. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Michael Bommarito discovered that BlueZ incorrectly handled codec\n capability storage in the A2DP profile. An attacker could possibly\n use this issue to cause a stack buffer overflow, resulting in a denial\n of service or arbitrary code execution. This issue only affected Ubuntu\n 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n (CVE-2026-19774)\n\n It was discovered that BlueZ incorrectly handled packet length validation.\n An attacker could possibly use this issue to read out of bounds memory,\n causing a crash or exposing sensitive information. (CVE-2026-75032)\n\n It was discovered that BlueZ incorrectly handled crafted XML input. An\n attacker could possibly use this issue to crash BlueZ, resulting in a\n denial of service. (CVE-2026-80185)\n\n It was discovered that BlueZ incorrectly parsed remote names from Extended\n Inquiry Response data. An attacker could possibly use this issue to cause a\n stack buffer overflow, resulting in a denial of service or arbitrary code\n execution. (CVE-2026-80186)\n\n Alexandro Calo discovered that BlueZ incorrectly parsed certain responses\n in the AVRCP profile. An attacker could possibly use this issue to access\n out of bounds memory, causing a crash or exposing sensitive information.\n (CVE-2026-85218)","status":"published","published":"2026-10-13T19:28:30Z","modified":"2026-10-17T12:58:08.016848582Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}