# CVE-2026-28526: BlueKitchen BTstack out-of-bounds read in AVRCP Controller

Source: https://junglewise.ai/threats/cve-2026-28526-bluekitchen-btstack-out-of-bounds-read-in-avrcp-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-30. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-28526 · Severity: low · CVSS 3.5 · Published 2026-03-30

BlueKitchen BTstack is a software library used to provide Bluetooth connectivity for embedded systems and resource-constrained devices. A vulnerability in how it handles media player control messages could allow a nearby attacker to crash a device. To exploit this, an attacker must be within Bluetooth range and have an established connection with the target device.

Technologies: [Bluekitchen-Gmbh Btstack](https://junglewise.ai/threats/technologies/btstack). Vendors: [Bluekitchen-Gmbh](https://junglewise.ai/threats/vendors/bluekitchen-gmbh).

## Quick answers

**Is CVE-2026-28526 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28526 being exploited in the wild.

**How severe is CVE-2026-28526?** Low severity, with a CVSS score of 3.5, published 30 March 2026.

**Which products and versions are affected?** BlueKitchen BTstack < 1.8.1.

**Is there a fix for CVE-2026-28526?** A patch was published on 2026-03-25: Version 1.8.1 released on GitHub. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28526 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-28526?** Check whether you run Bluekitchen-Gmbh Btstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers within BlueKitchen BTstack. The flaw is rooted in insufficient validation of an attacker-controlled 'count' value within a VENDOR_DEPENDENT response. A nearby attacker with an existing paired Bluetooth Classic connection can send a specially crafted response to trigger a read beyond the L2CAP receive buffer boundaries. This can lead to a denial-of-service (crash), particularly on resource-constrained hardware. The issue is addressed in version 1.8.1.

## Affected products

- BlueKitchen BTstack < 1.8.1

## Timeline

- 2026-03-25: patched: Version 1.8.1 released on GitHub.
- 2026-03-30: disclosed: Initial advisory published.

## References

- [https://github.com/bluekitchen/btstack/releases/tag/v1.8.1](https://github.com/bluekitchen/btstack/releases/tag/v1.8.1)
- [https://www.vulncheck.com/advisories/bluekitchen-btstack-avrcp-controller-list-player-application-setting-handlers-oob-read](https://www.vulncheck.com/advisories/bluekitchen-btstack-avrcp-controller-list-player-application-setting-handlers-oob-read)

## Related threats

- [BlueKitchen BTstack out-of-bounds read in AVRCP Browsing Target](https://junglewise.ai/threats/cve-2026-28528-bluekitchen-btstack-out-of-bounds-read-in-avrcp-browsing-target)
- [BlueKitchen BTstack out-of-bounds read in AVRCP Controller](https://junglewise.ai/threats/cve-2026-28527-bluekitchen-btstack-out-of-bounds-read-in-avrcp-controller)