CVE-2026-75032: Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parsemediaelement() and parsemediafolder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running BlueZ are exposed when a malicious Bluetooth device is within radio range and can be paired through user interaction. The reported impact is a bluetoothd daemon crash, with potential exposure of sensitive heap-memory contents.
What does an attacker need to exploit the vulnerability?
An attacker needs to be within Bluetooth range, operate a malicious Bluetooth device, and induce the user to pair with it. The vulnerable parsing occurs when handling AVRCP GetFolderItems responses.
How can I determine whether my deployment is affected?
The provided information does not identify affected or fixed BlueZ versions, nor does it state whether the vulnerable AVRCP behavior is enabled in a default configuration. Confirm exposure by determining whether the deployed BlueZ instance processes AVRCP GetFolderItems responses from paired Bluetooth devices.