Quick answers
- Is CVE-2026-28528 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-28528 being exploited in the wild.
- How severe is CVE-2026-28528?
- Medium severity, with a CVSS score of 4.6, published 30 March 2026.
- Which products and versions are affected?
- BlueKitchen BTstack < 1.8.1.
- Is there a fix for CVE-2026-28528?
- A patch was published on 2026-03-25: Version 1.8.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-28528 attacked?
- It is attacked from the adjacent network, in a software library.
- Am I affected by CVE-2026-28528?
- Check whether you run Bluekitchen-Gmbh Btstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds read vulnerability exists in the AVRCP (Audio/Video Remote Control Profile) Browsing Target component of BlueKitchen BTstack. The root cause is a failure to properly validate packet boundaries and attribute count data within the GET_FOLDER_ITEMS handler, specifically regarding the attr_id parameter. An attacker with an established Bluetooth Classic paired connection can exploit this insufficient bounds checking to trigger an out-of-bounds read. This can result in application crashes (denial of service) or corruption of the attribute bitmap state. The vulnerability is addressed in version 1.8.1.
Affected products
- BlueKitchen BTstack < 1.8.1
Timeline
- 2026-03-25: patched: Version 1.8.1 released
- 2026-03-30: disclosed: Initial advisory publication