CVE-2026-16473
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An off-by-one error in the SBC frame decoder of the sbc library (BlueZ SBC codec) allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. An adjacent Bluetooth attacker can read a single byte of adjacent heap memory.
Risk Assessment
The risk is potential leakage of a single byte of memory, which could be used for further attacks, but is limited to Bluetooth proximity.
Recommendation
Upgrade the BlueZ library to a patched version and restrict trusted Bluetooth devices.
Other vulnerabilities in BlueZ
See all- CVE-2016-7837High
Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.
- CVE-2016-9918High
In BlueZ 5.42, an out-of-bounds read was identified in the 'packet_hexdump' function in the 'monitor/packet.c' source file. This issue can be triggered by processing a corrupted dump file and will result in btmon crash.
- CVE-2016-9917High
In BlueZ 5.42, a buffer overflow was observed in the 'read_n' function in the 'tools/hcidump.c' source file. This issue can be triggered by processing a corrupted dump file, resulting in hcidump crash.
- CVE-2026-80186High
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
- CVE-2026-80185Medium
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
- CVE-2026-75032Medium
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
Original NVD description (English source)
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.