CVE-2026-85218

{}

{}

{}

{"acknowledgement": "Upstream acknowledges Alexandro Cal\u00f2 (Nozomi Networks Labs) as the original reporter.", "bugzilla": {"description": "bluez: bluez: AVRCP ListPlayerAttributes double stack overflow in avrcp_list_player_attributes_rsp/avrcp_get_current_player_value", "id": "2528163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528163"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cvss4": {"cvss4_base_score": "7.3", "cvss4_scoring_vector": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "status": "draft"}, "cwe": "CWE-121", "details": ["A double stack-based buffer overflow was found in the BlueZ AVRCP controller implementation. A nearby BR/EDR peripheral can send a crafted AVRCP player-settings response that supplies an attacker-controlled attribute count, causing avrcp_list_player_attributes_rsp() and avrcp_get_current_player_value() in profiles/audio/avrcp.c to write attacker-controlled data past fixed-size stack buffers, potentially leading to a crash or code execution in the bluetoothd daemon."], "mitigation": {"lang": "en:us", "value": "Affected version is v5.87."}, "name": "CVE-2026-85218", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "bluez", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85218\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85218\nhttps://github.com/bluez/bluez/security/advisories/GHSA-m2vx-pw5f-rc8v"], "statement": "Red Hat CVSSv3 score is an estimate from CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This vulnerability requires user interaction and does not have any impact on the subsequent system, thus the scope is unchanged.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "bluez", "vendor": "bluez"}], "created": "2026-09-04T01:30:04.021802+00:00", "updated": "2026-09-04T02:15:12.447222+00:00", "vendors": ["bluez", "bluez$PRODUCT$bluez"]}