ZDI-CAN-29015: ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Oct 28, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118610.

Affected Software

1 affected component

Alpine iLX-F511

Event History

Oct 28, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A network-adjacent attacker can exploit the vulnerability against affected Alpine iLX-F511 installations. Authentication is not required.

What level of impact could successful exploitation have?

Successful exploitation allows arbitrary code execution on the affected device.

How severe is this vulnerability?

ZDI assigned the vulnerability a CVSS score of 8.8. The associated CVE is CVE-2026-118610.

ZDI-CAN-29015: ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of impact could successful exploitation have?

How severe is this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of impact could successful exploitation have?

How severe is this vulnerability?