Summary
Michael Bommarito discovered that BlueZ incorrectly handled codec
capability storage in the A2DP profile. An attacker could possibly
use this issue to cause a stack buffer overflow, resulting in a denial
of service or arbitrary code execution. This issue only affected Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-19774)
It was discovered that BlueZ incorrectly handled packet length validation.
An attacker could possibly use this issue to read out of bounds memory,
causing a crash or exposing sensitive information. (CVE-2026-75032)
It was discovered that BlueZ incorrectly handled crafted XML input. An
attacker could possibly use this issue to crash BlueZ, resulting in a
denial of service. (CVE-2026-80185)
It was discovered that BlueZ incorrectly parsed remote names from Extended
Inquiry Response data. An attacker could possibly use this issue to cause a
stack buffer overflow, resulting in a denial of service or arbitrary code
execution. (CVE-2026-80186)
Alexandro Calo discovered that BlueZ incorrectly parsed certain responses
in the AVRCP profile. An attacker could possibly use this issue to access
out of bounds memory, causing a crash or exposing sensitive information.
(CVE-2026-85218)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | bluez | 5.64-0ubuntu1.5 |
| Ubuntu · 24.04 LTS 24.04:LTS | bluez | 5.72-0ubuntu5.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | bluez | 5.85-4ubuntu0.3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | bluez | 5.37-0ubuntu5.3+esm6 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | bluez | 5.48-0ubuntu3.9+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | bluez | 5.53-0ubuntu3.9+esm1 |
Vulnerabilities 4
-
High 7.6
Bluez: stack overflow in name2utf8 causes dos and potential code execution
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target devic…
-
High 7.1
BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability
BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Blueto…
-
Medium 6.3
Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read.…
-
Medium 5.7
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash blu…