Quick answers
- Is CVE-2026-28526 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-28526 being exploited in the wild.
- How severe is CVE-2026-28526?
- Low severity, with a CVSS score of 3.5, published 30 March 2026.
- Which products and versions are affected?
- BlueKitchen BTstack < 1.8.1.
- Is there a fix for CVE-2026-28526?
- A patch was published on 2026-03-25: Version 1.8.1 released on GitHub. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-28526 attacked?
- It is attacked from the adjacent network, in a software library.
- Am I affected by CVE-2026-28526?
- Check whether you run Bluekitchen-Gmbh Btstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds read vulnerability exists in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers within BlueKitchen BTstack. The flaw is rooted in insufficient validation of an attacker-controlled 'count' value within a VENDOR_DEPENDENT response. A nearby attacker with an existing paired Bluetooth Classic connection can send a specially crafted response to trigger a read beyond the L2CAP receive buffer boundaries. This can lead to a denial-of-service (crash), particularly on resource-constrained hardware. The issue is addressed in version 1.8.1.
Affected products
- BlueKitchen BTstack < 1.8.1
Timeline
- 2026-03-25: patched: Version 1.8.1 released on GitHub.
- 2026-03-30: disclosed: Initial advisory published.