CVE-2026-19774

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19774", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-08-13T17:33:39.146Z", "datePublished": "2026-09-15T18:01:53.749Z", "dateUpdated": "2026-09-16T03:57:38.124Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-09-15T18:01:53.749Z"}, "title": "BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429."}], "affected": [{"vendor": "BlueZ", "product": "BlueZ", "versions": [{"version": "b138a0849ba26310c3f40e78037565ce274d8737", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-589/", "name": "ZDI-26-589", "tags": ["x_research-advisory"]}, {"url": "https://github.com/bluez/bluez/pull/2251", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2026-08-13T17:33:39.174Z", "datePublic": "2026-08-24T21:15:41.024Z", "source": {"lang": "en", "value": "p0her (_@p0her_) in TeamH4C"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-19774"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-16T03:57:38.124Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19774", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-15T19:21:01.394488Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T19:21:07.538Z"}}], "cna": {"title": "BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "p0her (_@p0her_) in TeamH4C"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "BlueZ", "product": "BlueZ", "versions": [{"status": "affected", "version": "b138a0849ba26310c3f40e78037565ce274d8737"}], "defaultStatus": "unknown"}], "datePublic": "2026-08-24T21:15:41.024Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-589/", "name": "ZDI-26-589", "tags": ["x_research-advisory"]}, {"url": "https://github.com/bluez/bluez/pull/2251", "name": "vendor-provided URL", "tags": ["vendor-advisory"]}], "dateAssigned": "2026-08-13T17:33:39.174Z", "descriptions": [{"lang": "en", "value": "BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-09-15T18:01:53.749Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19774", "state": "PUBLISHED", "dateUpdated": "2026-09-15T19:21:12.563Z", "dateReserved": "2026-08-13T17:33:39.146Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-09-15T18:01:53.749Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "BlueZ", "vendor": "BlueZ", "versions": [{"status": "affected", "version": "b138a0849ba26310c3f40e78037565ce274d8737"}]}], "source": "zdi-disclosures@trendmicro.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429."}], "id": "CVE-2026-19774", "lastModified": "2026-09-18T19:10:46.443", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19774", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-15T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-09-15T19:17:17.867", "references": [{"source": "zdi-disclosures@trendmicro.com", "url": "https://github.com/bluez/bluez/pull/2251"}, {"source": "zdi-disclosures@trendmicro.com", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-589/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{"bugzilla": {"description": "bluez: BlueZ: Arbitrary Code Execution via A2DP Stack-based Buffer Overflow", "id": "2534102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2534102"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.0", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["A flaw was found in BlueZ. This vulnerability, a stack-based buffer overflow in the Advanced Audio Distribution Profile (A2DP) stack, allows a network-adjacent attacker to execute arbitrary code. By pairing a malicious Bluetooth device with the target system, an attacker can exploit improper validation of user-supplied data length. Successful exploitation leads to arbitrary code execution with root privileges."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, disable the Bluetooth service if it is not required. This can be achieved by stopping and disabling the `bluetooth` service.\n```bash\nsudo systemctl stop bluetooth\nsudo systemctl disable bluetooth\n```\nDisabling the Bluetooth service will prevent all Bluetooth functionality on the system. A system reboot may be required for the changes to take full effect."}, "name": "CVE-2026-19774", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-15T18:01:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-19774\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-19774\nhttps://github.com/bluez/bluez/pull/2251\nhttps://www.zerodayinitiative.com/advisories/ZDI-26-589/"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b138a0849ba26310c3f40e78037565ce274d8737"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "BlueZ", "source": "cna", "vendor": "BlueZ"}, "product": "bluez", "vendor": "bluez"}], "created": "2026-09-15T20:45:20.199594+00:00", "updated": "2026-09-20T14:30:18.363214+00:00", "vendors": ["bluez", "bluez$PRODUCT$bluez"]}