CVE-2026-28527

BlueKitchen BTstack is affected for versions prior to 1.8.1. The vuln is an out-of-bounds read in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers. An attacker with a paired Bluetooth Classic connection can send crafted VEND...