# CVE-2026-118603: Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow

Source: https://junglewise.ai/threats/cve-2026-118603-alpine-ilx-f511-vcard-parsing-stack-based-buffer-overflow-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118603 · Severity: high · CVSS 8 · Published 2026-10-28

Alpine iLX-F511 is a vehicle multimedia receiver that processes audio, video, and contact information from connected devices. An attacker can exploit a buffer overflow in vCard parsing to execute code as root on the device by tricking a user to connect to a malicious Bluetooth device, potentially giving the attacker full control of the vehicle's infotainment system.

Technologies: [Alpine iLX-F511](https://junglewise.ai/threats/technologies/ilx-f511). Vendors: [Alpine](https://junglewise.ai/threats/vendors/alpine).

## Quick answers

**Is CVE-2026-118603 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118603 being exploited in the wild.

**How severe is CVE-2026-118603?** High severity, with a CVSS score of 8, published 28 October 2026.

**Which products and versions are affected?** Alpine iLX-F511.

**Is there a fix for CVE-2026-118603?** No fixed version is recorded yet. Restrict interaction with the product, particularly avoiding connections to untrusted Bluetooth devices until a patch is available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118603 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-118603?** Check whether you run Alpine iLX-F511. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict interaction with the product, particularly avoiding connections to untrusted Bluetooth devices until a patch is available.

## Technical details

The vulnerability is a stack-based buffer overflow in vCard data parsing, caused by insufficient validation of user-supplied input before copying to a fixed-length buffer. Exploitation requires network-adjacent access (Bluetooth) and user interaction (connecting to the malicious device), allowing arbitrary code execution in the root context. The advisory does not name a fixed version.

## Affected products

- Alpine iLX-F511

## Timeline

- 2026-02-04: disclosed: Vulnerability reported to vendor
- 2026-10-28: advisory: Coordinated public release of advisory

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-821/](https://www.zerodayinitiative.com/advisories/ZDI-26-821/)

## Related threats

- [Alpine iLX-F511 Bluetooth OBEX packet handling heap buffer overflow](https://junglewise.ai/threats/cve-2026-118611-alpine-ilx-f511-bluetooth-obex-packet-handling-heap-based-buffer)
- [Alpine iLX-F511 Android Auto Service stack buffer overflow RCE](https://junglewise.ai/threats/cve-2026-118610-alpine-ilx-f511-android-auto-service-stack-based-buffer-overflow)
- [Alpine iLX-F511 Android Auto Connection Handler stack buffer overflow](https://junglewise.ai/threats/cve-2026-118609-alpine-ilx-f511-android-auto-connection-handler-stack-based)
- [Alpine iLX-F511 diagapp command injection vulnerability](https://junglewise.ai/threats/cve-2026-118607-alpine-ilx-f511-diagapp-command-injection-vulnerability-this)
- [Alpine iLX-F511 framework service remote code execution](https://junglewise.ai/threats/cve-2026-118606-alpine-ilx-f511-framework-service-exposed-dangerous-function)