CVE-2026-101887

BlueALSA bluez-alsa/bluealsad contains a division-by-zero vulnerability in the LC3plus sink decoder a2dp-lc3plus.c, a2dplc3plusdecthread that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero...