BLE-Replay

BLE-Replay BLE-Replay is a Bluetooth Low Energy BLE peripheral assessment tool. It pulls/consumes Bluetooth HCI logs from your mobile device and extracts all of the writes that the central makes to a peripheral. This data can be replayed using most Bluetooth dongles from a Linux host, or saved to...

CVE-2025-27840-WIP

CVE-2025-27840-WIP A Work-In-Progress for CVE-2025-27840 CVE-2025-27840 Overview CVE-2025-27840 is a medium-severity vulnerability CVSS 6.8 affecting Espressif ESP32 Bluetooth chips , which are integrated into over 1 billion IoT devices globally. The flaw involves 29 undocumented Host Controller...

CVE-2020-0022

CVE-2020-0022 Seems like Android 9-6 have similar Bluetooth subsystem, Android 5 and 4 are different. Android 9.0 BlueFrag experiments Patch: https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf Below I hit the patched condition. OK I think I got it, but...

esp32-cve-2025-27840-power-trace-experiment

esp32-cve-2025-27840-power-trace-experiment Firmware for getting a power trace of the behavior of the bluetooth module on the ESP32 when the ESP32 is sent the undocumented hci bluetooth commands CVE-2025-27840. When the ESP32 receives the commands, it toggles a GPIO pin to trigger the power trace...

CVE-2023-2002

Linux Bluetooth: Unauthorized management command execution CVE-2023-2002 An insufficient permission check has been found in the Bluetooth subsystem of the Linux kernel when handling ioctl system calls of HCI sockets. This causes tasks without the proper CAPNETADMIN capability can easily mark HCI...

DEBIAN-CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460: Out-of-bounds Read

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

KB5126655: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (October 2026)

The remote Windows host is missing security update 5126655. It is, therefore, affected by multiple vulnerabilities - Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. CVE-2026-100202 - Use after free in Microsoft QUIC allows an...

Wireshark 1.8.x < 1.8.5 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.8.5. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.8.5 advisory. - Buffer overflow in the NTLMSSP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allows...

Wireshark 1.6.x < 1.6.13 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.6.13. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.6.13 advisory. - Buffer overflow in the NTLMSSP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allo...

PT-2026-106624

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A flaw exists in the Bluetooth coredump functionality where hci devcd handle pkt init activates dump timeout and coredump producers queue dump rx without maintaining an hdev reference. Duri...

PT-2026-106626

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the Bluetooth component where hci send acl, hci send sco, and hci send iso queue hdev-tx work unconditionally. This can lead to a race condition during hci dev close sync...

PT-2026-106575

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the Bluetooth subsystem. The hci dev close sync function clears the hdev-local codecs list after releasing the hdev-lock. Because the sco sock...

PT-2026-106576

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the Bluetooth hci codec component where the Read Local Supported Codecs parsers consume a variable-sized standard codec array before parsing the vendor codec count. Becau...

PT-2026-106623

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the Bluetooth hci qca module where the system may attempt to write to a serial port after it has been closed. This occurs when hci uart close closes the serdev port...

Security Bulletin: Vulnerabilities in golang.org/x/crypto bundled with IBM Fusion and IBM Fusion HCI.

Summary IBM Fusion and IBM Fusion HCI include the golang.org/x/crypto library, which is affected by multiple vulnerabilities, including denial of service and improper authorization vulnerabilities. CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832,...

CVE-2026-90252

A flaw was found in the Bluetooth Management MGMT component of the Linux kernel. When a Host Controller Interface HCI command is cancelled, the associated memory is not properly freed, leading to a memory leak. This issue can also prevent the management socket from being released, potentially...