CVE-2026-16473: Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
Other sources
In sbc versions 1.0 through 2.0 (upstream HEAD 2.2), sbcunpackframeinternal() in sbc/sbc.c has an off-by-one error in the per-sample bit-reader bound check. At line 502 (v2.0) / 509 (v1.0), the guard if (consumed > len 8) uses > instead of >=, allowing the cumulative bit position consumed to reach exactly len 8. The next statement indexes data[consumed >> 3] which equals data[len], reading one byte past the end of the input buffer.
A 14-byte attacker-controlled SBC payload triggers the over-read deterministically. AddressSanitizer reports a heap-buffer-overflow at the read site. The bug was introduced in commit feb1bd57 (2011-10-19) and affects every release since.
The vulnerable decode path is the public sbcdecode() entry point, called by all SBC audio consumers: PulseAudio Bluetooth module, PipeWire Bluetooth module, ofono, GStreamer sbcparse/sbcdec plugins, and any application linking libsbc directly. SBC is the mandatory A2DP codec, so the attack surface includes any device that decodes Bluetooth audio.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libsbc / BlueZ SBC codecto a version that resolves this vulnerability.Fixed in 2.2 - Configuration
Disable SBC decoding in Bluetooth audio consumers (e.g., PulseAudio Bluetooth module, PipeWire Bluetooth module, ofono, and GStreamer sbcparse/sbcdec plugins) so crafted SBC frames cannot be processed by sbc_decode() until libsbc is upgraded to a fixed release.
Bluetooth A2DP SBC decoding (consumers of libsbc/sbc_decode()) SBC decode availability (enable/disable) = disable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16473?
CVE-2026-16473 has a medium severity rating of 4.3.
How do I fix CVE-2026-16473?
To fix CVE-2026-16473, update the BlueZ sbc codec to the latest version that addresses this vulnerability.
What kind of access is required to exploit CVE-2026-16473?
Exploitation of CVE-2026-16473 requires an adjacent attacker with the ability to stream Bluetooth audio.
What type of attack does CVE-2026-16473 enable?
CVE-2026-16473 enables an attacker to perform a heap out-of-bounds read, potentially exposing adjacent memory.
Which software is affected by CVE-2026-16473?
CVE-2026-16473 affects the BlueZ sbc codec.