CVE-2025-68474

CVE-2025-68474 affects ESF-IDF (Espressif IoT Development Framework) in ESP-IDF BlueDroid AVRCP stack. In avrc_vendor_msg(), the code validates the buffer with AVRC_MIN_CMD_LEN = 20 bytes, but the fixed header written before the vendor payload is 29 bytes, causing an out-of-bounds write when vend...

CVE-2025-66409

CVE-2025-66409 affects ESF-IDF (Espressif ESP32) where, when AVRCP is enabled, a malformed VENDOR DEPENDENT command can cause the Bluetooth stack to read memory beyond the validated buffer length. Affected versions include 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier. Root cause is insufficient ...

EUVD-2021-12381

Malware in sbrugna...

EUVD-2025-25854

Malicious code in bioql PyPI...

CVE-2020-0022

In reassembleanddispatch of packetfragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2018-9475

In HeadsetInterface::ClccResponse of btifhf.cc, there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote escalation of privilege via Bluetooth, if the recipient has enabled SIP calls with no additional execution privileges needed. User interaction is...

CVE-2023-21108

In sdpubuilduuidseq of sdpdiscovery.cc, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2022-20345

In l2cbleprocesssigcmd of l2cble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12...

CVE-2021-25485

Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT remote socket...

Bluetooth Remote PC - External URLs, Possible privilege escalation, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Bluetooth Remote PC published at the 'play' market has multiple vulnerabilities...