CVE-2026-105460
MediumCVSS 5.5Summary
An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool (part of BlueZ) when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys exceeding actual packet data, causing btmon to read beyond the allocated buffer and crash.
Risk Assessment
An attacker can supply a crafted btsnoop file, causing btmon to crash, potentially disrupting Bluetooth monitoring or enabling further exploitation in an analysis environment.
Recommendation
Update BlueZ to a version containing the fix, and until then avoid opening untrusted btsnoop files in btmon.
Other vulnerabilities in BlueZ
See all- CVE-2016-7837High
Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.
- CVE-2016-9918High
In BlueZ 5.42, an out-of-bounds read was identified in the 'packet_hexdump' function in the 'monitor/packet.c' source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
- CVE-2016-9917High
In BlueZ 5.42, a buffer overflow was observed in the 'read_n' function in the 'tools/hcidump.c' source file. This issue can be triggered by processing a corrupted dump file, resulting in hcidump crash.
- CVE-2026-19774High
BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system.
- CVE-2026-80186High
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
- CVE-2026-80185Medium
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
- CVE-2026-75032Medium
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
- CVE-2026-16473Medium
An off-by-one error in the SBC frame decoder of the sbc library (BlueZ SBC codec) allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. An adjacent Bluetooth attacker can read a single byte of adjacent heap memory.
Original NVD description (English source)
A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS