Executive brief
BTstack is a popular software library used to provide Bluetooth functionality to various embedded devices and applications. A security flaw in how the library handles folder browsing requests could allow a nearby attacker with a paired connection to crash the device or cause it to behave unpredictably. This could lead to a temporary loss of service for the affected Bluetooth device.
Technical details
An out-of-bounds read vulnerability exists in the AVRCP (Audio/Video Remote Control Profile) Browsing Target component of BlueKitchen BTstack. The root cause is a failure to properly validate packet boundaries and attribute count data within the GET_FOLDER_ITEMS handler, specifically regarding the attr_id parameter. An attacker with an established Bluetooth Classic paired connection can exploit this insufficient bounds checking to trigger an out-of-bounds read. This can result in application crashes (denial of service) or corruption of the attribute bitmap state. The vulnerability is addressed in version 1.8.1.
Affected products
- BlueKitchen BTstack < 1.8.1
Timeline
- 2026-03-25: patched: Version 1.8.1 released
- 2026-03-30: disclosed: Initial advisory publication