UBUNTU-CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473 Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

EUVD-2026-47623

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473 Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

CVE-2026-16473

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

PT-2026-63335

Name of the Vulnerable Software and Affected Versions sbc library BlueZ SBC codec affected versions not specified Description An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This enables an adjacent attacker streaming...

CVE-2026-16473: Out-of-bounds Read

A flaw was found in the sbc library BlueZ SBC codec. An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory...

Unity Linux 20.1070e Security Update: bluez (UTSA-2026-016764)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016764 advisory. BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdpcstateallocbuf which allocates memory which will always be hung in t...

bluez:fuzz_xml: Segv on unknown address in element_end

Project: https://github.com/bluez/bluez.git Detailed Report: https://oss-fuzz.com/testcase?key=4662824564752384 Project: bluez Fuzzing Engine: afl Fuzz Target: fuzzxml Job Type: aflasanbluez Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: elementend emitendeleme...

Exploit for CVE-2025-36911

BLUE-SPY - Fast Pair Vulnerability Research Tool SECURITY...

ROS-20260129-73-0011

A vulnerability in the AVRCP protocol implementation of the Bluetooth protocol stack for Linux BlueZ is related to reading beyond memory buffer boundaries. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions by using a specially craft...

ROS-20260129-73-0012

A vulnerability in the Audio Profile AVRCP component of the Bluetooth protocol stack for Linux BlueZ is related to reading outside the valid range. Exploitation of the vulnerability could allow a remote attacker to gain unauthorized access to protected information...

Exploit for CVE-2025-13834

!DOIhttps://img.shields.io/badge/DOI-10.5281%2Fzenodo.183233...

MiracleLinux 8 : bluez-5.50-3.el8 (AXSA:2020-298:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-298:02 advisory. bluez: failure in disabling Bluetooth discoverability in certain cases may lead to the unauthorized pairing of Bluetooth devices CVE-2018-10910 Tenable has...

MiracleLinux 9 : bluez-5.72-2.el9 (AXSA:2024-9114:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9114:01 advisory. bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 BlueZ: Audio Profile AVRCP...

MiracleLinux 8 : bluez-5.52-4.el8 (AXSA:2021-1921:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1921:02 advisory. bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or RCE CVE-2020-27153 Tenable has extracted the...

MiracleLinux 7 : bluez-5.44-7.el7 (AXSA:2020-565:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-565:03 advisory. bluez: Improper access control in subsystem could result in privilege escalation and DoS CVE-2020-0556 Tenable has extracted the preceding description block...

MiracleLinux 8 : bluez-5.52-1.el8 (AXSA:2021-1167:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1167:01 advisory. bluez: Improper access control in subsystem could result in privilege escalation and DoS CVE-2020-0556 Tenable has extracted the preceding description block...

MiracleLinux 8 : bluez-5.56-3.el8 (AXSA:2022-3444:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3444:01 advisory. bluez: memory leak in the SDP protocol CVE-2021-41229 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...