Quick answers
- Is CVE-2026-118605 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118605 being exploited in the wild.
- How severe is CVE-2026-118605?
- High severity, with a CVSS score of 8, published 28 October 2026.
- Which products and versions are affected?
- Alpine iLX-F511.
- Is there a fix for CVE-2026-118605?
- No fixed version is recorded yet. Restrict Bluetooth pairing and interaction with untrusted devices until a vendor patch is available.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-02-05","note":"Vulnerability reported to vendor"},{"kind":"advisory","at":"2026-10-28","note":"Coordinated public release of advisory"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-118605 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-118605?
- Check whether you run Alpine iLX-F511. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict Bluetooth pairing and interaction with untrusted devices until a vendor patch is available.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-02-05","note":"Vulnerability reported to vendor"},{"kind":"advisory","at":"2026-10-28","note":"Coordinated public release of advisory"}]
Technical details
A stack-based buffer overflow exists in the prh_sdp_service_search_decode function due to insufficient validation of user-supplied data length before copying to a stack buffer. An attacker with the ability to pair a Bluetooth device (adjacent network access) can trigger the overflow to execute arbitrary code in the root context. A public advisory exists but no vendor fix is documented.
Affected products
- Alpine iLX-F511