Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 43

Export CSV
CVE-2026-80186

Bluez: stack overflow in name2utf8 causes dos and potential code execution

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Bluez Red Hat Redhat
Products
Bluez Enterprise Linux Enterprise Linux and 1 more
CVE-2026-105460

Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux Rhel Els
CVE-2026-19774

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2026-85218

bluez: bluez: AVRCP ListPlayerAttributes double stack overflow in avrcp_list_player_attributes_rsp/avrcp_get_current_player_value

A double stack-based buffer overflow was found in the BlueZ AVRCP controller implementation. A nearby BR/EDR peripheral can send a crafted AVRCP player-settings response that supplies an attacker-controlled attribute count, causing avrcp_list_player_attributes_rsp() and avrcp_get_current_player_value() in profiles/audio/avrcp.c to write attacker-controlled data past fixed-size stack buffers, potentially leading to a crash or code execution in the bluetoothd daemon.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2008-2374

bluez-libs: SDP payload processing vulnerability

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

CVSS 3.1 · 9.8 Critical EPSS 4.3% KEV · Not listed
Vendors
Bluez Fedoraproject Redhat
Products
Bluez-libs Bluez-utils Fedora and 1 more
CVE-2022-39177

bluez: BlueZ allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c

BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Bluez Canonical Debian
Products
Bluez Ubuntu Linux Debian Linux
CVE-2022-39176

bluez: BlueZ allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len

BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Bluez Canonical Debian
Products
Bluez Ubuntu Linux Debian Linux
CVE-2022-0204

bluez: heap-based buffer overflow in the implementation of the gatt protocol

A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Bluez Debian Fedoraproject
Products
Bluez Debian Linux Fedora
CVE-2021-3658

bluez: adapter incorrectly restores Discoverable state after powered down

bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bluez Fedoraproject
Products
Bluez Fedora
CVE-2020-27153

bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or RCE

In BlueZ before 5.55, a double free was found in the gatttool disconnect_cb() routine from shared/att.c. A remote attacker could potentially cause a denial of service or code execution, during service discovery, due to a redundant disconnect MGMT event.

CVSS 3.1 · 8.6 High EPSS 4.3% KEV · Not listed
Vendors
Bluez Debian Opensuse and 1 more
Products
Bluez Debian Linux Leap and 1 more
CVE-2019-8922

bluez: heap-based buffer overflow via crafted request

A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Bluez Debian Linux
Products
Bluez Debian Linux Linux Kernel
CVE-2019-8921

bluez: information leak in service_attr_req() in sdpd-request.c via a crafted CSTATE

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Bluez Debian Linux
Products
Bluez Debian Linux Linux Kernel
CVE-2023-50230

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20938.

CVSS 3.1 · 8.0 High EPSS 1.5% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2023-50229

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20936.

CVSS 3.1 · 8.0 High EPSS 2.3% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2023-27349

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

CVSS 3.1 · 8.0 High EPSS 1.4% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2021-43400

bluez: use-after-free in gatt-database.c

An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.

CVSS 3.1 · 9.1 Critical EPSS 1.7% KEV · Not listed
Vendors
Bluez Debian
Products
Bluez Debian Linux
CVE-2021-41229

Memory leak in BlueZ

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Bluez Debian Redhat
Products
Bluez Debian Linux Enterprise Linux
CVE-2024-8805

BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability

BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the HID over GATT Profile. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25177.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Bluez
Products
Bluez
CVE-2023-51580

BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability

BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20852.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux
CVE-2023-51589

BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability

BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20853.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Bluez Redhat
Products
Bluez Enterprise Linux