{"id":"CVE-2026-75032","aliases":["AZL-96861","CLSA-2026-1792508765","DEBIAN-CVE-2026-75032","EUVD-2026-60941","GHSA-7wfr-vqp9-gqc3","MGASA-2026-0538","OESA-2026-3528","UBUNTU-CVE-2026-75032","USN-8908-1"],"status":"published","title":"Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder","description":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00241,"percentile":0.15411,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-08-18T14:33:47Z","modified":"2026-11-06T10:06:25Z","fixes":[{"ecosystem":"Azure Linux:3","package":"bluez","fixed_in":["5.63-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.87-2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"bluez","fixed_in":["5.71-6.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"bluez","fixed_in":["5.54-17.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"bluez","fixed_in":["5.54-22.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"bluez","fixed_in":["5.71-6.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"bluez","fixed_in":["5.71-6.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","fixed_in":["5.37-0ubuntu5.3+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","fixed_in":["5.48-0ubuntu3.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","fixed_in":["5.53-0ubuntu3.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bluez","fixed_in":["5.64-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"bluez","fixed_in":["5.72-0ubuntu5.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"bluez","fixed_in":["5.85-4ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.63-7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-mesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.66-1","5.66-1+deb12u1","5.66-1+deb12u2","5.68-1","5.68-2","5.69-1","5.70-1","5.70-1.1","5.70-1.1~exp0","5.71-1","5.73-1","5.73-1.1","5.77-1","5.79-1","5.79-2","5.82-1","5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4","5.87-5"]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4","5.87-5"]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.87-2"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.87-1.1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-6.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-17.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-22.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-6.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-6.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm6"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4","5.37-0ubuntu5.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm3"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1","5.48-0ubuntu3.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm1"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.5"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.7"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.85-4","5.85-4ubuntu1","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.3"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm6"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4","5.37-0ubuntu5.3+esm5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm3"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1","5.48-0ubuntu3.9+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm1"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.5"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.7"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.3"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2"],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-75032","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517490","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75032","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7wfr-vqp9-gqc3"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792508765.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85218","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-75032","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0538.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36192","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IEAQGME7YHJPXMGE233SURK752QRXULJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIJJ3EIYPS7BJQ42GWBIECW4O26LYTXD/","tags":["web"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34","tags":["advisory"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ5OXQJBQDRPBE4TGOYAU5OIYE7DBUSF/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAGOUZ5PPAGUWRUYV5FOC2X6E7MYP7C5/","tags":["web"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-m2vx-pw5f-rc8v","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8908-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3528","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-75032","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85218","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-75032","title":"Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder","description":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.","status":"published","published":"2026-08-18T14:33:47.048Z","modified":"2026-11-06T00:43:27.202Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T01:55:46.939755Z"}],"euvd":[{"id":"EUVD-2026-60941","description":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.","status":"published","published":"2026-08-18T14:33:47Z","modified":"2026-11-06T00:43:27Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-7wfr-vqp9-gqc3","title":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems...","description":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.","status":"published","published":"2026-08-18T15:31:49Z","modified":"2026-08-18T15:32:01Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:10:37.069016Z"}],"nvd":[{"id":"CVE-2026-75032","description":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.","status":"published","published":"2026-08-18T15:17:12.473Z","modified":"2026-11-06T01:17:50.763Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T06:59:04.972571Z"}],"osv":[{"id":"DEBIAN-CVE-2026-75032","description":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.","status":"published","published":"2026-08-18T15:17:12.473Z","modified":"2026-11-06T10:06:25.875323872Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-3528","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.(CVE-2026-75032)","status":"published","published":"2026-08-30T04:14:57Z","modified":"2026-08-30T04:31:43.289567454Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-75032","description":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.","status":"published","published":"2026-08-18T15:17:00Z","modified":"2026-10-17T13:01:05.702442536Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"AZL-96861","title":"CVE-2026-75032 affecting package bluez for versions less than 5.63-7","description":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.","status":"published","published":"2026-08-18T15:17:12Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"CLSA-2026-1792508765","title":"bluez: Fix of 5 CVEs","description":"- CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint\n  codec capability storage and validate cached capabilities on load\n- CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing\n  by bounding media item and folder names to the received packet length\n- CVE-2026-80185: fix type confusion crash in SDP XML record parsing by rejecting\n  nested attributes and mismatched sequence/alternate closing elements\n- CVE-2026-80186: fix stack-based buffer overflow when parsing the remote device\n  name from EIR data\n- CVE-2026-85218: fix stack-based buffer overflows in AVRCP ListPlayerAttributes\n  response handling by validating the PDU length and clamping the attribute count","status":"published","published":"2026-10-20T15:06:18Z","modified":"2026-10-26T09:31:01.978901071Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"MGASA-2026-0538","title":"Updated bluez package fixes security vulnerabilities","description":"Out-of-bounds read in avrcp parse_media_element and parse_media_folder.\n(CVE-2026-75032)\nUnprivileged-local and adjacent-LE-peer leads to arbitrary code\nexecution as root. (CVE-2026-80185)\nStack Overflow in name2utf8 causes DoS and potential code execution.\n(CVE-2026-80186)\nAVRCP ListPlayerAttributes Double Stack Overflow. (CVE-2026-85218)\n","status":"published","published":"2026-10-24T00:09:07Z","modified":"2026-10-24T00:15:04.993832962Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8908-1","title":"bluez vulnerabilities","description":"Michael Bommarito discovered that BlueZ incorrectly handled codec\ncapability storage in the A2DP profile. An attacker could possibly\nuse this issue to cause a stack buffer overflow, resulting in a denial\nof service or arbitrary code execution. This issue only affected Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-19774)\n\nIt was discovered that BlueZ incorrectly handled packet length validation.\nAn attacker could possibly use this issue to read out of bounds memory,\ncausing a crash or exposing sensitive information. (CVE-2026-75032)\n\nIt was discovered that BlueZ incorrectly handled crafted XML input. An\nattacker could possibly use this issue to crash BlueZ, resulting in a\ndenial of service. (CVE-2026-80185)\n\nIt was discovered that BlueZ incorrectly parsed remote names from Extended\nInquiry Response data. An attacker could possibly use this issue to cause a\nstack buffer overflow, resulting in a denial of service or arbitrary code\nexecution. (CVE-2026-80186)\n\nAlexandro Calo discovered that BlueZ incorrectly parsed certain responses\nin the AVRCP profile. An attacker could possibly use this issue to access\nout of bounds memory, causing a crash or exposing sensitive information.\n(CVE-2026-85218)","status":"published","published":"2026-10-08T21:50:08Z","modified":"2026-10-09T19:41:59.910110322Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}