CVE-2026-80185

Awaiting Analysis Awaiting Analysis - Queue

BlueZ Bluetooth Daemon Local Denial of Service via SDP XML Parser Type Confusion

Publication date: 2026-08-25

Last updated on: 2026-08-28

Assigner: redhat-SADP

Description

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-28

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-80185

EUVD

EUVD-2026-66134

Affected Vendors & Products

Vendor	Product	Version / Range
bluez	bluetoothd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability is a type confusion issue in BlueZ's sdp-xml.c file. It occurs when RegisterProfile(ServiceRecord) processes a crafted nested ServiceRecord. The SDP XML parser stack gets corrupted, causing scalar union data to be misinterpreted as a sequence pointer. This allows a local attacker to crash the bluetoothd service, resulting in a denial of service (DoS).

Detection Guidance

This vulnerability involves a type confusion in BlueZ's SDP XML parser via RegisterProfile(ServiceRecord). Detection requires checking for crashes in bluetoothd when processing crafted ServiceRecords. Monitor system logs for bluetoothd crashes or segmentation faults. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability can impact you by causing your Bluetooth service (bluetoothd) to crash. If exploited, it may lead to a local denial of service, disrupting Bluetooth functionality on your system until the service is restarted.

Compliance Impact

This vulnerability is a local denial-of-service (DoS) issue in BlueZ's SDP XML parser, which could allow an attacker to crash the bluetoothd service. While it does not directly impact data confidentiality or integrity, a DoS condition could disrupt Bluetooth-dependent services, potentially affecting system availability. Compliance impacts would depend on whether such disruptions violate availability requirements in standards like GDPR (data processing integrity) or HIPAA (system availability for healthcare operations).

Mitigation Strategies

Update BlueZ to the latest patched version to address the type confusion in sdp-xml.c. Disable Bluetooth services if not in use to reduce attack surface. Monitor system logs for crashes in bluetoothd.

Hi! I’m here to help you understand CVE-2026-80185. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70