{"id":"CVE-2026-80185","aliases":["BELL-CVE-2026-80185","CLSA-2026-1792508765","DEBIAN-CVE-2026-80185","EUVD-2026-66134","GHSA-822r-m33h-gr5v","MGASA-2026-0538","OESA-2026-3729","OESA-2026-3730","OESA-2026-3731","OESA-2026-3732","OESA-2026-3881","UBUNTU-CVE-2026-80185","USN-8908-1"],"status":"published","title":"Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root","description":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00292,"percentile":0.22035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2026-08-25T21:58:16Z","modified":"2026-11-06T10:06:25Z","fixes":[{"ecosystem":"Alpaquita:23","package":"bluez","fixed_in":["5.66-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"bluez","fixed_in":["5.82-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"bluez","fixed_in":["5.87-r1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.87-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","fixed_in":["5.37-0ubuntu5.3+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","fixed_in":["5.48-0ubuntu3.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","fixed_in":["5.53-0ubuntu3.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bluez","fixed_in":["5.64-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"bluez","fixed_in":["5.72-0ubuntu5.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"bluez","fixed_in":["5.85-4ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.66-r1"},{"fixed":"5.66-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.82-r0"},{"fixed":"5.82-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.66-r2"},{"fixed":"5.87-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-mesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.66-1","5.66-1+deb12u1","5.66-1+deb12u2","5.68-1","5.68-2","5.69-1","5.70-1","5.70-1.1","5.70-1.1~exp0","5.71-1","5.73-1","5.73-1.1","5.77-1","5.79-1","5.79-2","5.82-1","5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4","5.87-5"]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4","5.87-5"]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.87-3"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.87-1.1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-18.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.54-23.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-7.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-7.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.71-7.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm6"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4","5.37-0ubuntu5.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm3"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1","5.48-0ubuntu3.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm1"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.5"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.7"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.85-4","5.85-4ubuntu1","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.3"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm6"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4","5.37-0ubuntu5.3+esm5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm3"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1","5.48-0ubuntu3.9+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm1"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.5"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.7"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.3"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2"],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-80185","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524139","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80185","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-822r-m33h-gr5v"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-80185","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792508765.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85218","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-80185","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0538.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36192","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IEAQGME7YHJPXMGE233SURK752QRXULJ/","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517490","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIJJ3EIYPS7BJQ42GWBIECW4O26LYTXD/","tags":["web"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34","tags":["advisory","report"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ5OXQJBQDRPBE4TGOYAU5OIYE7DBUSF/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAGOUZ5PPAGUWRUYV5FOC2X6E7MYP7C5/","tags":["web"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-m2vx-pw5f-rc8v","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8908-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3729","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3730","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3731","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3732","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3881","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-80185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-85218","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-80185","title":"Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root","description":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.","status":"published","published":"2026-08-25T21:58:16.883Z","modified":"2026-11-06T00:55:24.254Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-843"],"updated_at":"2026-11-06T01:55:46.939755Z"}],"euvd":[{"id":"EUVD-2026-66134","description":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.","status":"published","published":"2026-08-25T21:58:16Z","modified":"2026-11-06T00:55:24Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-822r-m33h-gr5v","title":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS...","description":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.","status":"published","published":"2026-08-26T00:31:02Z","modified":"2026-08-26T00:31:03Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:10:58.645101Z"}],"nvd":[{"id":"CVE-2026-80185","description":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.","status":"published","published":"2026-08-25T22:17:07.427Z","modified":"2026-11-06T01:17:53.917Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-06T06:59:04.972571Z"}],"osv":[{"id":"BELL-CVE-2026-80185","status":"published","published":"2026-08-27T06:10:26.253695Z","modified":"2026-09-05T07:15:10.581985053Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"DEBIAN-CVE-2026-80185","description":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.","status":"published","published":"2026-08-25T22:17:07.427Z","modified":"2026-11-06T10:06:25.873633228Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"OESA-2026-3729","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, was found in Linux BlueZ (version now known).CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-14T16:33:48Z","modified":"2026-09-13T16:45:21.879795835Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3730","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, was found in Linux BlueZ (version now known).CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-14T16:33:48Z","modified":"2026-09-13T16:45:22.217967561Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3731","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, was found in Linux BlueZ (version now known).CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-14T16:33:49Z","modified":"2026-09-13T16:45:22.338702973Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3732","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as very critical, was found in Linux BlueZ (version now known).CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).This is going to have an impact on confidentiality, integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-14T16:33:49Z","modified":"2026-09-13T16:45:22.631565531Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3881","title":"bluez security update","description":"This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.\r\n\r\nSecurity Fix(es):\n\nBlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.(CVE-2026-19774)\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.(CVE-2026-80185)\n\nA stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.(CVE-2026-80186)","status":"published","published":"2026-09-20T13:22:52Z","modified":"2026-09-20T13:30:21.896622424Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-80185","description":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.","status":"published","published":"2026-08-25T22:17:00Z","modified":"2026-10-17T13:01:09.751691256Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"CLSA-2026-1792508765","title":"bluez: Fix of 5 CVEs","description":"- CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint\n  codec capability storage and validate cached capabilities on load\n- CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing\n  by bounding media item and folder names to the received packet length\n- CVE-2026-80185: fix type confusion crash in SDP XML record parsing by rejecting\n  nested attributes and mismatched sequence/alternate closing elements\n- CVE-2026-80186: fix stack-based buffer overflow when parsing the remote device\n  name from EIR data\n- CVE-2026-85218: fix stack-based buffer overflows in AVRCP ListPlayerAttributes\n  response handling by validating the PDU length and clamping the attribute count","status":"published","published":"2026-10-20T15:06:18Z","modified":"2026-10-26T09:31:01.978901071Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"MGASA-2026-0538","title":"Updated bluez package fixes security vulnerabilities","description":"Out-of-bounds read in avrcp parse_media_element and parse_media_folder.\n(CVE-2026-75032)\nUnprivileged-local and adjacent-LE-peer leads to arbitrary code\nexecution as root. (CVE-2026-80185)\nStack Overflow in name2utf8 causes DoS and potential code execution.\n(CVE-2026-80186)\nAVRCP ListPlayerAttributes Double Stack Overflow. (CVE-2026-85218)\n","status":"published","published":"2026-10-24T00:09:07Z","modified":"2026-10-24T00:15:04.993832962Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8908-1","title":"bluez vulnerabilities","description":"Michael Bommarito discovered that BlueZ incorrectly handled codec\ncapability storage in the A2DP profile. An attacker could possibly\nuse this issue to cause a stack buffer overflow, resulting in a denial\nof service or arbitrary code execution. This issue only affected Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-19774)\n\nIt was discovered that BlueZ incorrectly handled packet length validation.\nAn attacker could possibly use this issue to read out of bounds memory,\ncausing a crash or exposing sensitive information. (CVE-2026-75032)\n\nIt was discovered that BlueZ incorrectly handled crafted XML input. An\nattacker could possibly use this issue to crash BlueZ, resulting in a\ndenial of service. (CVE-2026-80185)\n\nIt was discovered that BlueZ incorrectly parsed remote names from Extended\nInquiry Response data. An attacker could possibly use this issue to cause a\nstack buffer overflow, resulting in a denial of service or arbitrary code\nexecution. (CVE-2026-80186)\n\nAlexandro Calo discovered that BlueZ incorrectly parsed certain responses\nin the AVRCP profile. An attacker could possibly use this issue to access\nout of bounds memory, causing a crash or exposing sensitive information.\n(CVE-2026-85218)","status":"published","published":"2026-10-08T21:50:08Z","modified":"2026-10-09T19:41:59.910110322Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}