CVE-2026-80185: Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
Other sources
https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Does exploitation require user interaction or elevated attacker privileges?
No user interaction is required. The CVSS vector indicates an attacker needs low privileges, and the affected access context is adjacent-network; the description also identifies a local caller path.
What is the confirmed security impact?
The provided impact data indicates high availability impact with no confidentiality or integrity impact. A crafted request can crash bluetoothd, causing a local denial of service.
Which component should be checked during triage?
Check systems running the BlueZ bluetoothd service. BlueZ 5.86 is specifically identified in the vulnerability title.