Executive brief
BlueZ is a Linux Bluetooth stack used in many networked devices to enable wireless connectivity. A stack-based buffer overflow in A2DP audio stream endpoint handling allows a nearby attacker with a paired Bluetooth device to execute arbitrary code with root privileges, potentially compromising the entire system.
Technical details
This is a stack-based buffer overflow vulnerability in BlueZ's A2DP (Advanced Audio Distribution Profile) stream endpoint handling. The root cause is insufficient validation of user-supplied data length before copying it to a fixed-length stack buffer. Attack vector is network-adjacent (Bluetooth range) and requires the attacker to first pair a malicious Bluetooth device with the target system. Successful exploitation allows code execution in the root context. A patch is available via pull request #2251 in the BlueZ repository.
Affected products
- BlueZ BlueZ
Timeline
- 2026-04-08: disclosed: Vulnerability reported to vendor
- 2026-08-24: patched: Update issued via GitHub PR #2251
- 2026-08-24: advisory: Coordinated public release (ZDI-26-589, CVE-2026-19774)