ZDI-CAN-29429: ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Aug 24, 2026

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2026-19774.

Affected Software

1 affected component

BlueZ

Event History

Aug 24, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be network-adjacent and must first be able to pair a malicious Bluetooth device with the target system.

What is the potential impact if exploitation succeeds?

Successful exploitation can allow arbitrary code execution on the affected BlueZ installation.

Which identifier should be used to track this vulnerability?

This issue is assigned CVE-2026-19774 and is also documented as ZDI-26-589.

ZDI-CAN-29429: ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which identifier should be used to track this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which identifier should be used to track this vulnerability?