CVE-2026-18748

The Bluetooth Classic A2DP host is vulnerable to an out-of-bounds read due to improper handling of the codec Information Element (IE). Specifically, a2dp_process_config_ind() in subsys/bluetooth/host/classic/a2dp.c fails to validate the length of the codec IE, copying only the first 8 bytes while...