# CVE-2026-28527: BlueKitchen BTstack out-of-bounds read in AVRCP Controller

Source: https://junglewise.ai/threats/cve-2026-28527-bluekitchen-btstack-out-of-bounds-read-in-avrcp-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-30. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-28527 · Severity: low · CVSS 3.5 · Published 2026-03-30

BlueKitchen BTstack is a software library used to provide Bluetooth connectivity for embedded systems and devices. A security flaw in how the software handles media player settings could allow a nearby attacker to crash the device or potentially access sensitive information from its memory. To exploit this, an attacker must be within Bluetooth range and establish a connection with the target device.

Technologies: [Bluekitchen-Gmbh Btstack](https://junglewise.ai/threats/technologies/btstack). Vendors: [Bluekitchen-Gmbh](https://junglewise.ai/threats/vendors/bluekitchen-gmbh).

## Quick answers

**Is CVE-2026-28527 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28527 being exploited in the wild.

**How severe is CVE-2026-28527?** Low severity, with a CVSS score of 3.5, published 30 March 2026.

**Which products and versions are affected?** BlueKitchen BTstack < 1.8.1.

**Is there a fix for CVE-2026-28527?** A patch was published on 2026-03-25: Version 1.8.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28527 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-28527?** Check whether you run Bluekitchen-Gmbh Btstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the AVRCP Controller component of BlueKitchen BTstack. The flaw is located within the GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers. A nearby attacker can exploit this by establishing a paired Bluetooth Classic connection and sending specially crafted VENDOR_DEPENDENT responses. This triggers a read beyond packet boundaries, leading to information disclosure or a denial-of-service (crash). The issue is resolved in version 1.8.1.

## Affected products

- BlueKitchen BTstack < 1.8.1

## Timeline

- 2026-03-25: patched: Version 1.8.1 released
- 2026-03-30: advisory: Initial disclosure by VulnCheck

## References

- [https://github.com/bluekitchen/btstack/releases/tag/v1.8.1](https://github.com/bluekitchen/btstack/releases/tag/v1.8.1)
- [https://www.vulncheck.com/advisories/bluekitchen-btstack-avrcp-controller-get-player-application-setting-text-handlers-oob-read](https://www.vulncheck.com/advisories/bluekitchen-btstack-avrcp-controller-get-player-application-setting-text-handlers-oob-read)

## Related threats

- [BlueKitchen BTstack out-of-bounds read in AVRCP Browsing Target](https://junglewise.ai/threats/cve-2026-28528-bluekitchen-btstack-out-of-bounds-read-in-avrcp-browsing-target)
- [BlueKitchen BTstack out-of-bounds read in AVRCP Controller](https://junglewise.ai/threats/cve-2026-28526-bluekitchen-btstack-out-of-bounds-read-in-avrcp-controller)