Out-of-Bounds Read in BlueKitchen BTstack AVRCP Controller

Executive Summary

CVE-2026-28527 is an out-of-bounds read vulnerability in BlueKitchen BTstack, specifically in the AVRCP Controller's GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers.

This flaw allows nearby attackers to read memory beyond the boundaries of packets by establishing a paired Bluetooth Classic connection and sending specially crafted VENDOR_DEPENDENT responses.

Exploiting this vulnerability can cause information disclosure and potentially crash affected devices.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows nearby attackers to read memory beyond packet boundaries, leading to information disclosure and potential crashes on affected devices.

Such information disclosure could potentially impact compliance with data protection regulations like GDPR or HIPAA if sensitive personal or health information is exposed through exploitation of this vulnerability.

However, the provided information does not specify the nature of the data exposed or whether it includes regulated personal or health data, so the exact compliance impact cannot be determined from the available context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers in close proximity to access memory beyond intended limits on your device through a paired Bluetooth Classic connection.

Such unauthorized memory reads can lead to information disclosure, potentially exposing sensitive data.

Additionally, exploiting this flaw may cause your device to crash, leading to denial of service or instability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update BlueKitchen BTstack to version 1.8.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0