CVE-2026-75032: Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parsemediaelement() and parsemediafolder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
Other sources
Bluez: bluez: out-of-bounds read in avrcp parsemediaelement and parsemediafolder
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.63-7 - Upgrade
Upgrade
debian/bluezto a version that resolves this vulnerability.Fixed in 5.87-4Fixed in 5.87-5
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running BlueZ are exposed when a malicious Bluetooth device is within radio range and can be paired through user interaction. The reported impact is a bluetoothd daemon crash, with potential exposure of sensitive heap-memory contents.
What does an attacker need to exploit the vulnerability?
An attacker needs to be within Bluetooth range, operate a malicious Bluetooth device, and induce the user to pair with it. The vulnerable parsing occurs when handling AVRCP GetFolderItems responses.
How can I determine whether my deployment is affected?
The provided information does not identify affected or fixed BlueZ versions, nor does it state whether the vulnerable AVRCP behavior is enabled in a default configuration. Confirm exposure by determining whether the deployed BlueZ instance processes AVRCP GetFolderItems responses from paired Bluetooth devices.