ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
Other sources
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2026-19774.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BlueZto a version that resolves this vulnerability.Patch ZDI-26-589 - Compensating control
Restrict Bluetooth pairing so only trusted devices can be paired to the target system, reducing the ability to pair a malicious Bluetooth device for exploitation.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be network-adjacent and must first be able to pair a malicious Bluetooth device with the target system.
What is the potential impact after successful exploitation?
Successful exploitation can allow execution of arbitrary code on the affected BlueZ installation.