ZDI-CAN-29018: (0Day) (Pwn2Own) Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the prhrfcommccprocesstest function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.
Other sources
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.5. The following CVEs are assigned: CVE-2026-118608.
— ZDI
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Affected Alpine iLX-F511 devices are exposed to network-adjacent attackers over Bluetooth. Exploitation requires the attacker to pair a malicious Bluetooth device with the target system.
What access or user interaction does an attacker need?
The attacker does not need privileges on the target, but must first be able to pair their malicious Bluetooth device with it. The CVSS vector also indicates user interaction is required.
What is the immediate impact if exploited?
The disclosed impact is sensitive-information exposure caused by an out-of-bounds read in prh_rfcomm_cc_process_test. The issue may be combined with other vulnerabilities to execute code as root.