BlueDucky

BlueDucky Ver 2.1 Android 🦆 Thanks to all the people at HackNexus. Make sure you come join us on VC ! https://discord.gg/HackNexus NOTES: I will not be able to run this on a laptop or other device outside of a raspberry pi for testing. Due to this, any issues you have will need to be resolved amo...

blueshrimp

Proof-of-concept for CVE-2025-48593 based on examining the patch. You shouldn't worry about this. As far as I can tell, phones are NOT vulnerable to CVE-2025-48593. The issue only affects Android devices that support acting as Bluetooth headphones / speakers, such as some smartwatches, smart...

EUVD-2026-120409

This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious...

EUVD-2026-120408

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An...

CVE-2026-113964

A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS...

CVE-2026-113968

A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, tvOS 27.2.1, visionOS...

CVE-2026-113965

A vulnerability in CoreUtils allows a malicious Bluetooth device to establish a pairing without user interaction. This issue was addressed with improved checks and is fixed in iOS 18.7.12 , iPadOS 18.7.12 , iOS 26.7.3 , iPadOS 26.7.3 , iOS 27.2.1 , iPadOS 27.2.1 , macOS Golden Gate 27.2.1 , macOS...

CVE-2026-113968

A logic issue exists in AirPlay on various Apple products, including iOS , iPadOS , macOS , visionOS , and watchOS . The root cause is related to improper state management, which may allow an attacker in Bluetooth range to bypass the rate limit on pairing code attempts . Affected versions include...

macOS 27.x < 27.2.1 Multiple Vulnerabilities (149718)

The remote host is running a version of macOS / Mac OS X that is 27.x prior to 27.2.1. It is, therefore, affected by multiple vulnerabilities: - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote...

macOS 26.x < 26.7.3 Multiple Vulnerabilities (149719)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.7.3. It is, therefore, affected by multiple vulnerabilities: - A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: Force responder to meet MITM requirements prior to generating the pairing response Currently, smpcmdpairingreq generates the pairing response based on the initiator’s authreq before enforcing the local...

Astra Linux – vulnerability in linux, bluez

In Bluetooth Core Specification 2.1 through 5.2, secure pairing via Bluetooth LE and BR/EDR may allow a nearby man-in-the-middle attacker to determine the Passkey used during pairing by reflecting the public key and the authentication evidence of the initiating device. This could enable the...

Some cheap smart glasses are a security disaster

Apart from the privacy concerns around smart glasses, researchers have found that some cheap brands come with barely any security at all. ABC Australia reports that researchers from NSB Cyber and Abstract Shield tested two inexpensive pairs, costing A$60 and A$110 around US$42 and US$78, and foun...

CVE-2026-19774

A flaw was found in BlueZ. This vulnerability, a stack-based buffer overflow in the Advanced Audio Distribution Profile A2DP stack, allows a network-adjacent attacker to execute arbitrary code. By pairing a malicious Bluetooth device with the target system, an attacker can exploit improper...

CVE-2026-19774 BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

CVE-2026-28606

In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...

Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Overview Skullcandy Dime 3 wireless earbuds, running firmware version 1.0.0.28, accept a new Bluetooth Classic BR/EDR pairing request from an unpaired device without requiring the earbuds to be placed into pairing mode or requiring any physical confirmation or interaction from the owner...

Astra Linux – Vulnerability in Linux

In the Bluetooth BR/EDR Core Specification v5.2 and earlier, legacy pairing and secure-connection pairing authentication mechanisms may allow an unauthenticated user to complete the authentication process without using pairing credentials through adjacent access. An unauthenticated, adjacent...

CVE-2026-18282

Sony XAV-9500ES AVRCPBrResponseParser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...

DEBIAN-CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...