# CVE-2026-118605: Alpine iLX-F511 stack-based buffer overflow in prh_sdp_service_search_decode

Source: https://junglewise.ai/threats/cve-2026-118605-alpine-ilx-f511-prh-sdp-service-search-decode-stack-based-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118605 · Severity: high · CVSS 8 · Published 2026-10-28

Alpine iLX-F511 is an in-vehicle infotainment system used in Alpine car audio equipment. A stack-based buffer overflow in the Bluetooth service search function allows a nearby attacker to execute arbitrary code with root privileges on the device by pairing a malicious Bluetooth device and sending specially crafted data. This could result in complete compromise of the vehicle's entertainment and control systems.

Technologies: [Alpine iLX-F511](https://junglewise.ai/threats/technologies/ilx-f511). Vendors: [Alpine](https://junglewise.ai/threats/vendors/alpine).

## Quick answers

**Is CVE-2026-118605 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118605 being exploited in the wild.

**How severe is CVE-2026-118605?** High severity, with a CVSS score of 8, published 28 October 2026.

**Which products and versions are affected?** Alpine iLX-F511.

**Is there a fix for CVE-2026-118605?** No fixed version is recorded yet. Restrict Bluetooth pairing and interaction with untrusted devices until a vendor patch is available.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-02-05","note":"Vulnerability reported to vendor"},{"kind":"advisory","at":"2026-10-28","note":"Coordinated public release of advisory"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118605 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-118605?** Check whether you run Alpine iLX-F511. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict Bluetooth pairing and interaction with untrusted devices until a vendor patch is available.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-02-05","note":"Vulnerability reported to vendor"},{"kind":"advisory","at":"2026-10-28","note":"Coordinated public release of advisory"}]

## Technical details

A stack-based buffer overflow exists in the prh_sdp_service_search_decode function due to insufficient validation of user-supplied data length before copying to a stack buffer. An attacker with the ability to pair a Bluetooth device (adjacent network access) can trigger the overflow to execute arbitrary code in the root context. A public advisory exists but no vendor fix is documented.

## Affected products

- Alpine iLX-F511

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-823/](https://www.zerodayinitiative.com/advisories/ZDI-26-823/)

## Related threats

- [Alpine iLX-F511 Bluetooth OBEX packet handling heap buffer overflow](https://junglewise.ai/threats/cve-2026-118611-alpine-ilx-f511-bluetooth-obex-packet-handling-heap-based-buffer)
- [Alpine iLX-F511 Android Auto Service stack buffer overflow RCE](https://junglewise.ai/threats/cve-2026-118610-alpine-ilx-f511-android-auto-service-stack-based-buffer-overflow)
- [Alpine iLX-F511 Android Auto Connection Handler stack buffer overflow](https://junglewise.ai/threats/cve-2026-118609-alpine-ilx-f511-android-auto-connection-handler-stack-based)
- [Alpine iLX-F511 diagapp command injection vulnerability](https://junglewise.ai/threats/cve-2026-118607-alpine-ilx-f511-diagapp-command-injection-vulnerability-this)
- [Alpine iLX-F511 framework service remote code execution](https://junglewise.ai/threats/cve-2026-118606-alpine-ilx-f511-framework-service-exposed-dangerous-function)