# CVE-2026-118610: Alpine iLX-F511 Android Auto Service stack buffer overflow RCE

Source: https://junglewise.ai/threats/cve-2026-118610-alpine-ilx-f511-android-auto-service-stack-based-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118610 · Severity: high · CVSS 8.8 · Published 2026-10-28

Alpine's iLX-F511 is an in-vehicle infotainment system with Android Auto functionality. A stack-based buffer overflow in the Android Auto service allows a network-adjacent attacker to execute arbitrary code with root privileges without authentication, potentially gaining complete control of the vehicle's entertainment and information systems.

Technologies: [Alpine iLX-F511](https://junglewise.ai/threats/technologies/ilx-f511). Vendors: [Alpine](https://junglewise.ai/threats/vendors/alpine).

## Quick answers

**Is CVE-2026-118610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118610 being exploited in the wild.

**How severe is CVE-2026-118610?** High severity, with a CVSS score of 8.8, published 28 October 2026.

**Which products and versions are affected?** Alpine iLX-F511.

**Is there a fix for CVE-2026-118610?** No fixed version is recorded yet. Restrict network-adjacent access to the affected device, including via Bluetooth and Wi-Fi connections that could reach the Android Auto service. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118610 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-118610?** Check whether you run Alpine iLX-F511. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict network-adjacent access to the affected device, including via Bluetooth and Wi-Fi connections that could reach the Android Auto service.

## Technical details

A stack-based buffer overflow exists in the Alpine iLX-F511's Android Auto service due to insufficient validation of user-supplied data length before copying to a fixed-length stack buffer. Network-adjacent attackers can trigger this flaw to achieve arbitrary code execution in the root context. No patch has been publicly disclosed.

## Affected products

- Alpine iLX-F511

## Timeline

- 2026-02-04: disclosed: Vulnerability reported to vendor
- 2026-10-15: other: ZDI notified vendor of intention to publish as 0-day advisory
- 2026-10-28: advisory: Coordinated public release of advisory

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-828/](https://www.zerodayinitiative.com/advisories/ZDI-26-828/)

## Related threats

- [Alpine iLX-F511 Bluetooth OBEX packet handling heap buffer overflow](https://junglewise.ai/threats/cve-2026-118611-alpine-ilx-f511-bluetooth-obex-packet-handling-heap-based-buffer)
- [Alpine iLX-F511 Android Auto Connection Handler stack buffer overflow](https://junglewise.ai/threats/cve-2026-118609-alpine-ilx-f511-android-auto-connection-handler-stack-based)
- [Alpine iLX-F511 diagapp command injection vulnerability](https://junglewise.ai/threats/cve-2026-118607-alpine-ilx-f511-diagapp-command-injection-vulnerability-this)
- [Alpine iLX-F511 framework service remote code execution](https://junglewise.ai/threats/cve-2026-118606-alpine-ilx-f511-framework-service-exposed-dangerous-function)
- [Alpine iLX-F511 stack-based buffer overflow in prh_sdp_service_search_decode](https://junglewise.ai/threats/cve-2026-118605-alpine-ilx-f511-prh-sdp-service-search-decode-stack-based-buffer)