BTstack vulnerabilities

A vulnerability in BTstack prior to version 1.8.1 allows an out-of-bounds read in the AVRCP Browsing Target GET_FOLDER_ITEMS handler due to missing packet boundary and attribute count validation. A paired Bluetooth Classic attacker can trigger crashes and corrupt attribute bitmap state.

A vulnerability in BTstack prior to version 1.8.1 allows an out-of-bounds read in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers. An attacker within Bluetooth Classic range can send a crafted VENDOR_DEPENDENT response, leading to information disclosure and potential device crashes.

A vulnerability in BTstack prior to version 1.8.1 allows an out-of-bounds read in the AVRCP LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers. An attacker with a paired Bluetooth Classic connection can send a crafted VENDOR_DEPENDENT response with a controlled count value to trigger an out-of-bounds read from the L2CAP receive buffer, potentially causing a crash on resource-constrained devices.