# CVE-2026-19774: BlueZ A2DP stack-based buffer overflow

Source: https://junglewise.ai/threats/cve-2026-19774-bluez-a2dp-stack-based-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19774 · Severity: high · CVSS 7.1 · Published 2026-09-15

BlueZ is a Linux Bluetooth stack used in many networked devices to enable wireless connectivity. A stack-based buffer overflow in A2DP audio stream endpoint handling allows a nearby attacker with a paired Bluetooth device to execute arbitrary code with root privileges, potentially compromising the entire system.

Technologies: [BlueZ](https://junglewise.ai/threats/technologies/bluez). Vendors: [BlueZ](https://junglewise.ai/threats/vendors/bluez).

## Quick answers

**Is CVE-2026-19774 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19774 being exploited in the wild.

**How severe is CVE-2026-19774?** High severity, with a CVSS score of 7.1, published 15 September 2026.

**Which products and versions are affected?** BlueZ BlueZ.

**Is there a fix for CVE-2026-19774?** A patch was published on 2026-08-24: Update issued via GitHub PR #2251 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19774 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-19774?** Check whether you run BlueZ. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stack-based buffer overflow vulnerability in BlueZ's A2DP (Advanced Audio Distribution Profile) stream endpoint handling. The root cause is insufficient validation of user-supplied data length before copying it to a fixed-length stack buffer. Attack vector is network-adjacent (Bluetooth range) and requires the attacker to first pair a malicious Bluetooth device with the target system. Successful exploitation allows code execution in the root context. A patch is available via pull request #2251 in the BlueZ repository.

## Affected products

- BlueZ BlueZ

## Timeline

- 2026-04-08: disclosed: Vulnerability reported to vendor
- 2026-08-24: patched: Update issued via GitHub PR #2251
- 2026-08-24: advisory: Coordinated public release (ZDI-26-589, CVE-2026-19774)

## References

- [https://github.com/bluez/bluez/pull/2251](https://github.com/bluez/bluez/pull/2251)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-589/](https://www.zerodayinitiative.com/advisories/ZDI-26-589/)

## Related threats

- [BlueZ stack-based buffer overflow in EIR handling](https://junglewise.ai/threats/cve-2026-80186-bluez-stack-based-buffer-overflow-in-eir-handling)
- [BlueZ sdp-xml.c type confusion in RegisterProfile](https://junglewise.ai/threats/cve-2026-80185-bluez-sdp-xml-c-type-confusion-in-registerprofile)