Is CVE-2026-28527 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28527 being exploited in the wild.

How severe is CVE-2026-28527?

Low severity, with a CVSS score of 3.5, published 30 March 2026.

Is there a fix for CVE-2026-28527?

A patch was published on 2026-03-25: Version 1.8.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28527 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-28527?

Check whether you run Bluekitchen-Gmbh Btstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28527: BlueKitchen BTstack out-of-bounds read in AVRCP Controller

CVE-2026-28527 · Severity: low · CVSS 3.5 · Published 2026-03-30

BlueKitchen BTstack is a software library used to provide Bluetooth connectivity for embedded systems and devices. A security flaw in how the software handles media player settings could allow a nearby attacker to crash the device or potentially access sensitive information from its memory. To exploit this, an attacker must be within Bluetooth range and establish a connection with the target device.

Technologies: Bluekitchen-Gmbh Btstack. Vendors: Bluekitchen-Gmbh.

Quick answers

Is CVE-2026-28527 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28527 being exploited in the wild.
How severe is CVE-2026-28527?: Low severity, with a CVSS score of 3.5, published 30 March 2026.
Which products and versions are affected?: BlueKitchen BTstack < 1.8.1.
Is there a fix for CVE-2026-28527?: A patch was published on 2026-03-25: Version 1.8.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28527 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-28527?: Check whether you run Bluekitchen-Gmbh Btstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the AVRCP Controller component of BlueKitchen BTstack. The flaw is located within the GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers. A nearby attacker can exploit this by establishing a paired Bluetooth Classic connection and sending specially crafted VENDOR_DEPENDENT responses. This triggers a read beyond packet boundaries, leading to information disclosure or a denial-of-service (crash). The issue is resolved in version 1.8.1.

Affected products

BlueKitchen BTstack < 1.8.1

Timeline

2026-03-25: patched: Version 1.8.1 released
2026-03-30: advisory: Initial disclosure by VulnCheck

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.