CVE-2025-36911_scan

CVE-2025-36911 scanner Tests unauthenticated BR/EDR L2CAP connections to audio PSMs A2DP/AVRCP and detects Fast Pair service GFPS on BLE. Requirements Linux BlueZ installed and bluetooth service active for BLE functionality. Bluetooth adapter enabled bluetoothctl power on. Debian based OS sudo ap...

CVE-2026-18748

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...

EUVD-2026-107483

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...

CVE-2026-18748 Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...

CVE-2026-18748 Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...

CVE-2026-18748

The Bluetooth Classic A2DP host is vulnerable to an out-of-bounds read due to improper handling of the codec Information Element (IE). Specifically, a2dp_process_config_ind() in subsys/bluetooth/host/classic/a2dp.c fails to validate the length of the codec IE, copying only the first 8 bytes while...

CVE-2026-18748 Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...

PT-2026-120772

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bt a2dp codec ie, a one-byte len field plus a fixed 8-byte codec ie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dp process config ind in subsys/bluetooth/host/classic/a2dp.c copied only the first ...

Zephyr buffer error vulnerability

Versions Zephyr 4.3.0 through 4.4.2 contain a buffer error vulnerability. This vulnerability arises when Bluetooth Classic A2DP hosts store codec information elements into a fixed 8-byte array; they only copy the first 8 bytes while retaining the full length specified by the attacker. As a result...

USN-8908-2 bluez regression

USN-8908-1 fixed vulnerabilities in BlueZ. Unfortunately, that update introduced a regression in the A2DP profile: cached remote stream endpoints were no longer loaded at startup, which could cause Bluetooth audio devices to fail to reconnect automatically or to fall back to low-quality audio...

USN-8908-2: BlueZ regression

USN-8908-1 fixed vulnerabilities in BlueZ. Unfortunately, that update introduced a regression in the A2DP profile: cached remote stream endpoints were no longer loaded at startup, which could cause Bluetooth audio devices to fail to reconnect automatically or to fall back to low-quality audio...

CVE-2026-83838

Integer underflow wrap or wraparound in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-83838

The Windows Bluetooth A2DP driver is vulnerable to an integer underflow (wrap or wraparound) . This flaw allows an authorized attacker to achieve elevation of privilege over an adjacent network. The vulnerability is classified as HIGH severity with a CVSS 3.1 score of 8.0. No specific exploit lin...

EUVD-2026-99379

Integer underflow wrap or wraparound in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-19939

The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...

Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability

Integer underflow wrap or wraparound in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network...

PT-2026-111723

The AVDTP signalling layer arms a 6-second command timeout AVDTP TIMEOUT in avdtp send cmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeout work before clearing the pending request, but bt avdtp l2cap...

PT-2026-112604

Name of the Vulnerable Software and Affected Versions Windows Bluetooth A2DP driver affected versions not specified Description An integer underflow wrap or wraparound occurs in the Bluetooth A2DP driver. This allows an authorized attacker to elevate privileges over an adjacent network, potential...

Microsoft Windows: CVE-2026-83838: Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability

Integer underflow wrap or wraparound in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-83838: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network...