Executive brief
A security flaw exists in the SBC audio codec library, which is used by many Linux-based systems to handle Bluetooth audio. An attacker within Bluetooth range could send a specially crafted audio stream to read a small amount of private memory from the device's system. While the amount of data exposed is limited to a single byte per attempt, it represents a privacy risk for devices using Bluetooth audio services like PulseAudio or PipeWire.
Technical details
An off-by-one error exists in the sbc_unpack_frame_internal() function within sbc/sbc.c of the sbc library. The vulnerability is caused by an incorrect bounds check where the code uses a 'greater than' operator instead of 'greater than or equal to' when validating the bit-reader position against the buffer length. This allows the 'consumed' bit counter to reach the exact end of the buffer, leading to a one-byte out-of-bounds read when the next byte is accessed. The flaw is reachable via the public sbc_decode() API, affecting common Linux audio frameworks like PulseAudio, PipeWire, and GStreamer when processing Bluetooth A2DP streams.
Affected products
- BlueZ sbc 1.0 through 2.0 (upstream HEAD 2.2)
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-07-21: disclosed: Reported via Red Hat Bugzilla
- 2026-07-22: advisory: NVD publication date