CVE-2026-75032
Received Received - Intake

BlueZ AVRCP Packet Length Validation Flaw Leads to DoS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: redhat-SADP

Description
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75032
EUVD
EUVD-2026-60941

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bluez bluez *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds memory read flaw in BlueZ's Audio/Video Remote Control Profile (AVRCP) implementation. It occurs when a malicious Bluetooth device sends invalid packet length fields in GetFolderItems responses, affecting the parse_media_element() and parse_media_folder() functions. This can crash the bluetoothd daemon, causing a Denial of Service (DoS), and may expose sensitive heap memory contents.

Detection Guidance

This vulnerability requires a malicious Bluetooth device within range to exploit it. Detection involves monitoring for unexpected Bluetooth device behavior or crashes of the bluetoothd daemon. Check system logs for bluetoothd crashes or unusual memory access errors. Use commands like 'journalctl -u bluetooth' to review Bluetooth service logs for errors or warnings.

Impact Analysis

The impact includes a Denial of Service (DoS) where the bluetoothd daemon crashes, disrupting Bluetooth functionality. It may also expose limited heap memory contents, potentially leaking sensitive information. Exploitation requires a malicious device within range and user interaction to pair with it.

Mitigation Strategies

Disable the AVRCP Bluetooth profile if unused via system settings or configuration files. Restrict Bluetooth pairing to trusted devices only. Consider disabling the Bluetooth subsystem entirely if not required. Apply any available patches or updates from your BlueZ distribution vendor.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart