CVE-2016-9918
HighSummary
In BlueZ 5.42, an out-of-bounds read was identified in the 'packet_hexdump' function in the 'monitor/packet.c' source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
Risk Assessment
Exploitation of this vulnerability may lead to the crashing of the monitoring tool, which can disrupt diagnostic and monitoring processes within the organization.
Recommendation
It is recommended to upgrade to a newer version of BlueZ to mitigate this vulnerability and to avoid processing suspicious dump files.
Other vulnerabilities in BlueZ 5.42
See all- CVE-2016-7837High
Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.
- CVE-2016-9917High
In BlueZ 5.42, a buffer overflow was observed in the 'read_n' function in the 'tools/hcidump.c' source file. This issue can be triggered by processing a corrupted dump file, resulting in hcidump crash.
- CVE-2026-80186High
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
- CVE-2026-80185Medium
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
- CVE-2026-75032Medium
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- CVE-2026-16473Medium
An off-by-one error in the SBC frame decoder of the sbc library (BlueZ SBC codec) allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. An adjacent Bluetooth attacker can read a single byte of adjacent heap memory.
Original NVD description (English source)
In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.