Is CVE-2026-16473 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16473 being exploited in the wild.

How severe is CVE-2026-16473?

Medium severity, with a CVSS score of 4.3, published 22 July 2026.

Which products and versions are affected?

BlueZ Project Sbc 1.0 through 2.0 (upstream HEAD 2.2).

Is there a fix for CVE-2026-16473?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16473 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-16473?

Check whether you run BlueZ Project Sbc, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16473: BlueZ sbc heap out-of-bounds read in SBC frame decoder

CVE-2026-16473 · Severity: medium · CVSS 4.3 · Published 2026-07-22

A security flaw exists in the SBC audio codec library, which is used by many Linux-based systems to handle Bluetooth audio. An attacker within Bluetooth range could send a specially crafted audio stream to read a small amount of private memory from the device's system. While the amount of data exposed is limited to a single byte per attempt, it represents a privacy risk for devices using Bluetooth audio services like PulseAudio or PipeWire.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-16473 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16473 being exploited in the wild.
How severe is CVE-2026-16473?: Medium severity, with a CVSS score of 4.3, published 22 July 2026.
Which products and versions are affected?: BlueZ Project Sbc 1.0 through 2.0 (upstream HEAD 2.2).
Is there a fix for CVE-2026-16473?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16473 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-16473?: Check whether you run BlueZ Project Sbc, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An off-by-one error exists in the sbc_unpack_frame_internal() function within sbc/sbc.c of the sbc library. The vulnerability is caused by an incorrect bounds check where the code uses a 'greater than' operator instead of 'greater than or equal to' when validating the bit-reader position against the buffer length. This allows the 'consumed' bit counter to reach the exact end of the buffer, leading to a one-byte out-of-bounds read when the next byte is accessed. The flaw is reachable via the public sbc_decode() API, affecting common Linux audio frameworks like PulseAudio, PipeWire, and GStreamer when processing Bluetooth A2DP streams.

Affected products

BlueZ sbc 1.0 through 2.0 (upstream HEAD 2.2)
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10

Timeline

2026-07-21: disclosed: Reported via Red Hat Bugzilla
2026-07-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.