CVE-2025-36911_scan

CVE-2025-36911 scanner Tests unauthenticated BR/EDR L2CAP connections to audio PSMs A2DP/AVRCP and detects Fast Pair service GFPS on BLE. Requirements Linux BlueZ installed and bluetooth service active for BLE functionality. Bluetooth adapter enabled bluetoothctl power on. Debian based OS sudo ap...

CVE-2026-85033

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

CVE-2026-85033 Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

CVE-2026-85033 Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

EUVD-2026-115821

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index getavrcptg, with the per-transfer context tid, sentlen, and the BTAVRCPTGFLAGTXONGOING flag stored in the userdata of the queue...

CVE-2026-85033

The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c is vulnerable to a denial of service and information leak due to incomplete cleanup during disconnection. Because avrcp_disconnected() fails to cancel tg->vd_rsp_tx_work or release pending buffers, a dropped link during a fragmente...

MGASA-2026-0538 Updated bluez package fixes security vulnerabilities

Out-of-bounds read in avrcp parsemediaelement and parsemediafolder. CVE-2026-75032 Unprivileged-local and adjacent-LE-peer leads to arbitrary code execution as root. CVE-2026-80185 Stack Overflow in name2utf8 causes DoS and potential code execution. CVE-2026-80186 AVRCP ListPlayerAttributes Doubl...

Astra Linux – vulnerability in bluez

BlueZ versions prior to 5.59 allow physically proximate attackers to obtain sensitive information, as profiles/audio/avrcp.c fails to validate paramslen...

USN-8908-1 bluez vulnerabilities

Michael Bommarito discovered that BlueZ incorrectly handled codec capability storage in the A2DP profile. An attacker could possibly use this issue to cause a stack buffer overflow, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22....

USN-8908-1: BlueZ vulnerabilities

Michael Bommarito discovered that BlueZ incorrectly handled codec capability storage in the A2DP profile. An attacker could possibly use this issue to cause a stack buffer overflow, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22....

Rocky Linux 8 [CIQ] Security Update: bluez / bluez-cups / bluez-cups-debuginfo / bluez-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_4043)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254043 advisory. BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability CVE-2023-27349 bluez: audio profile avrcp parsemediaeleme...

AlmaLinux 9.2 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763031616)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763031616 advisory. - BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows...

AlmaLinux 9.2 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc (ALMALINUX9.2:CLSA-2025:1754939879)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754939879 advisory. - BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacen...

Linux Distros Unpatched Vulnerability : CVE-2026-85218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AVRCP ListPlayerAttributes double stack overflow in avrcplistplayerattributesrsp/avrcpgetcurrentplayervalue fedora-all CVE-2026-85218 Note that Nessus relies on...

CVE-2026-85218

A double stack-based buffer overflow was found in the BlueZ AVRCP controller implementation. A nearby BR/EDR peripheral can send a crafted AVRCP player-settings response that supplies an attacker-controlled attribute count, causing avrcplistplayerattributesrsp and avrcpgetcurrentplayervalue in...

PT-2026-94135

Name of the Vulnerable Software and Affected Versions bluez affected versions not specified Description A stack overflow occurs in the avrcp list player attributes rsp and avrcp get current player value functions when processing AVRCP ListPlayerAttributes requests. Recommendations At the moment,...

CLSA-2026-1788176031 Fix CVE(s): CVE-2023-27349

SECURITY UPDATE: out-of-bounds write via an unsupported AVRCP event - debian/patches/CVE-2023-27349.patch: reject an event id above AVRCPEVENTLAST in avrcphandleevent before it is used to index session-transactionevents, a 14-entry array upstream f54299a850. - CVE-2023-27349...

OESA-2026-3528 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control...

Fedora 43 : bluez (2026-a1cdcc1604)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a1cdcc1604 advisory. An out-of-bounds read flaw was found in BlueZ in the AVRCP profile implementation. The vulnerability exists in the parsemediaelement and parsemediafolder...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wireshark (UTSA-2026-104800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104800 advisory. Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service Tenable has extracted the preceding description block...