CVE-2026-75032
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Summary
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-125: Out-of-bounds Read
Workarounds
Disable the AVRCP Bluetooth profile if it is not needed, or restrict Bluetooth pairing to trusted devices only. On systems where Bluetooth is not required, disable the Bluetooth subsystem entirely.
References
- https://access.redhat.com/security/cve/CVE-2026-75032
- https://bugzilla.redhat.com/show_bug.cgi?id=2517490
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.