{"id":"CVE-2026-85218","aliases":["CLSA-2026-1791831421","CLSA-2026-1792508765","DEBIAN-CVE-2026-85218","MGASA-2026-0538","UBUNTU-CVE-2026-85218","USN-8908-1"],"status":"published","title":"Fix CVE(s): CVE-2026-80186, CVE-2026-85218","description":"* SECURITY UPDATE: stack buffer overflow parsing a remote EIR name\n     - debian/patches/CVE-2026-80186.patch: clamp the name length to\n       HCI_MAX_NAME_LENGTH in name2utf8() in src/eir.c before copying it\n       into the fixed-size stack buffer.\n     - CVE-2026-80186\n   * SECURITY UPDATE: stack buffer overflow in AVRCP ListPlayerAttributes\n     response handling\n     - debian/patches/CVE-2026-85218.patch: validate the AVRCP header and\n       params_len against the received bytes and clamp the attribute count\n       to AVRCP_ATTRIBUTE_LAST in avrcp_list_player_attributes_rsp() in\n       profiles/audio/avrcp.c.\n     - CVE-2026-85218","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-04T16:47:39.376678014Z","modified":"2026-10-26T09:32:04Z","fixes":[{"ecosystem":"Debian:14","package":"bluez","fixed_in":["5.87-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","fixed_in":["5.37-0ubuntu5.3+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","fixed_in":["5.48-0ubuntu3.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","fixed_in":["5.53-0ubuntu3.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bluez","fixed_in":["5.64-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"bluez","fixed_in":["5.72-0ubuntu5.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"bluez","fixed_in":["5.85-4ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-hcidump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bluez-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libbluetooth-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libbluetooth3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-hid2hci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-mesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bluez-obexd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-4.el9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.66-1","5.66-1+deb12u1","5.66-1+deb12u2","5.68-1","5.68-2","5.69-1","5.70-1","5.70-1.1","5.70-1.1~exp0","5.71-1","5.73-1","5.73-1.1","5.77-1","5.79-1","5.79-2","5.82-1","5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Debian:13","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Debian:14","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.87-4"}]}],"versions":["5.82-1.1","5.83-1","5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.87-1","5.87-2","5.87-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.87-1.1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm6"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4","5.37-0ubuntu5.3+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm3"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1","5.48-0ubuntu3.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm1"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.5"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.7"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.85-4","5.85-4ubuntu1","5.87-1","5.87-2","5.87-3","5.87-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.3"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.37-0ubuntu5.3+esm6"}]}],"versions":["5.35-0ubuntu2","5.36-0ubuntu1","5.37-0ubuntu5","5.37-0ubuntu5.1","5.37-0ubuntu5.3","5.37-0ubuntu5.3+esm1","5.37-0ubuntu5.3+esm2","5.37-0ubuntu5.3+esm3","5.37-0ubuntu5.3+esm4","5.37-0ubuntu5.3+esm5"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.48-0ubuntu3.9+esm3"}]}],"versions":["5.46-0ubuntu3","5.46-0ubuntu4","5.48-0ubuntu3","5.48-0ubuntu3.1","5.48-0ubuntu3.2","5.48-0ubuntu3.3","5.48-0ubuntu3.4","5.48-0ubuntu3.5","5.48-0ubuntu3.6","5.48-0ubuntu3.7","5.48-0ubuntu3.8","5.48-0ubuntu3.9","5.48-0ubuntu3.9+esm1","5.48-0ubuntu3.9+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.53-0ubuntu3.9+esm1"}]}],"versions":["5.50-0ubuntu4","5.51-0ubuntu1","5.51-0ubuntu2","5.52-0ubuntu1","5.52-0ubuntu2","5.53-0ubuntu1","5.53-0ubuntu2","5.53-0ubuntu3","5.53-0ubuntu3.1","5.53-0ubuntu3.2","5.53-0ubuntu3.3","5.53-0ubuntu3.4","5.53-0ubuntu3.5","5.53-0ubuntu3.6","5.53-0ubuntu3.7","5.53-0ubuntu3.8","5.53-0ubuntu3.9"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.64-0ubuntu1.5"}]}],"versions":["5.60-0ubuntu2","5.62-0ubuntu1","5.62-0ubuntu2","5.63-0ubuntu1","5.63-0ubuntu2","5.64-0ubuntu1","5.64-0ubuntu1.1","5.64-0ubuntu1.3","5.64-0ubuntu1.4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.72-0ubuntu5.7"}]}],"versions":["5.68-0ubuntu1","5.70-0ubuntu1","5.70-0ubuntu2","5.70-0ubuntu3","5.71-0ubuntu3","5.71-1ubuntu2","5.71-1ubuntu3","5.72-0ubuntu1","5.72-0ubuntu3","5.72-0ubuntu4","5.72-0ubuntu5","5.72-0ubuntu5.1","5.72-0ubuntu5.3","5.72-0ubuntu5.4","5.72-0ubuntu5.5","5.72-0ubuntu5.6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bluez","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.85-4ubuntu0.3"}]}],"versions":["5.83-1~exp1","5.84-1","5.85-1","5.85-2","5.85-3","5.85-4","5.85-4ubuntu0.1","5.85-4ubuntu0.2"],"bundled":5}],"references":[{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1791831421.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85218","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792508765.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80185","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-85218","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0538.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36192","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IEAQGME7YHJPXMGE233SURK752QRXULJ/","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517490","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIJJ3EIYPS7BJQ42GWBIECW4O26LYTXD/","tags":["web"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34","tags":["advisory"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ5OXQJBQDRPBE4TGOYAU5OIYE7DBUSF/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAGOUZ5PPAGUWRUYV5FOC2X6E7MYP7C5/","tags":["web"]},{"url":"https://github.com/bluez/bluez/security/advisories/GHSA-m2vx-pw5f-rc8v","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/notices/USN-8908-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-85218","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-80186","tags":["report"]}],"sources":{"osv":[{"id":"CLSA-2026-1791831421","title":"Fix CVE(s): CVE-2026-80186, CVE-2026-85218","description":"   * SECURITY UPDATE: stack buffer overflow parsing a remote EIR name\n     - debian/patches/CVE-2026-80186.patch: clamp the name length to\n       HCI_MAX_NAME_LENGTH in name2utf8() in src/eir.c before copying it\n       into the fixed-size stack buffer.\n     - CVE-2026-80186\n   * SECURITY UPDATE: stack buffer overflow in AVRCP ListPlayerAttributes\n     response handling\n     - debian/patches/CVE-2026-85218.patch: validate the AVRCP header and\n       params_len against the received bytes and clamp the attribute count\n       to AVRCP_ATTRIBUTE_LAST in avrcp_list_player_attributes_rsp() in\n       profiles/audio/avrcp.c.\n     - CVE-2026-85218","status":"published","published":"2026-10-12T18:57:13Z","modified":"2026-10-26T09:32:04.623134843Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792508765","title":"bluez: Fix of 5 CVEs","description":"- CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint\n  codec capability storage and validate cached capabilities on load\n- CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing\n  by bounding media item and folder names to the received packet length\n- CVE-2026-80185: fix type confusion crash in SDP XML record parsing by rejecting\n  nested attributes and mismatched sequence/alternate closing elements\n- CVE-2026-80186: fix stack-based buffer overflow when parsing the remote device\n  name from EIR data\n- CVE-2026-85218: fix stack-based buffer overflows in AVRCP ListPlayerAttributes\n  response handling by validating the PDU length and clamping the attribute count","status":"published","published":"2026-10-20T15:06:18Z","modified":"2026-10-26T09:31:01.978901071Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"DEBIAN-CVE-2026-85218","status":"published","published":"2026-09-04T16:47:39.376678014Z","modified":"2026-09-29T23:00:08.678452543Z","updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"MGASA-2026-0538","title":"Updated bluez package fixes security vulnerabilities","description":"Out-of-bounds read in avrcp parse_media_element and parse_media_folder.\n(CVE-2026-75032)\nUnprivileged-local and adjacent-LE-peer leads to arbitrary code\nexecution as root. (CVE-2026-80185)\nStack Overflow in name2utf8 causes DoS and potential code execution.\n(CVE-2026-80186)\nAVRCP ListPlayerAttributes Double Stack Overflow. (CVE-2026-85218)\n","status":"published","published":"2026-10-24T00:09:07Z","modified":"2026-10-24T00:15:04.993832962Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"UBUNTU-CVE-2026-85218","description":"[Unknown description]","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-10-17T13:01:13.329672168Z","updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"USN-8908-1","title":"bluez vulnerabilities","description":"Michael Bommarito discovered that BlueZ incorrectly handled codec\ncapability storage in the A2DP profile. An attacker could possibly\nuse this issue to cause a stack buffer overflow, resulting in a denial\nof service or arbitrary code execution. This issue only affected Ubuntu\n20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-19774)\n\nIt was discovered that BlueZ incorrectly handled packet length validation.\nAn attacker could possibly use this issue to read out of bounds memory,\ncausing a crash or exposing sensitive information. (CVE-2026-75032)\n\nIt was discovered that BlueZ incorrectly handled crafted XML input. An\nattacker could possibly use this issue to crash BlueZ, resulting in a\ndenial of service. (CVE-2026-80185)\n\nIt was discovered that BlueZ incorrectly parsed remote names from Extended\nInquiry Response data. An attacker could possibly use this issue to cause a\nstack buffer overflow, resulting in a denial of service or arbitrary code\nexecution. (CVE-2026-80186)\n\nAlexandro Calo discovered that BlueZ incorrectly parsed certain responses\nin the AVRCP profile. An attacker could possibly use this issue to access\nout of bounds memory, causing a crash or exposing sensitive information.\n(CVE-2026-85218)","status":"published","published":"2026-10-08T21:50:08Z","modified":"2026-10-09T19:41:59.910110322Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}