# CVE-2026-28528: BlueKitchen BTstack out-of-bounds read in AVRCP Browsing Target

Source: https://junglewise.ai/threats/cve-2026-28528-bluekitchen-btstack-out-of-bounds-read-in-avrcp-browsing-target  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-30. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-28528 · Severity: medium · CVSS 4.6 · Published 2026-03-30

BTstack is a popular software library used to provide Bluetooth functionality to various embedded devices and applications. A security flaw in how the library handles folder browsing requests could allow a nearby attacker with a paired connection to crash the device or cause it to behave unpredictably. This could lead to a temporary loss of service for the affected Bluetooth device.

Technologies: [Bluekitchen-Gmbh Btstack](https://junglewise.ai/threats/technologies/btstack). Vendors: [Bluekitchen-Gmbh](https://junglewise.ai/threats/vendors/bluekitchen-gmbh).

## Quick answers

**Is CVE-2026-28528 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28528 being exploited in the wild.

**How severe is CVE-2026-28528?** Medium severity, with a CVSS score of 4.6, published 30 March 2026.

**Which products and versions are affected?** BlueKitchen BTstack < 1.8.1.

**Is there a fix for CVE-2026-28528?** A patch was published on 2026-03-25: Version 1.8.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28528 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-28528?** Check whether you run Bluekitchen-Gmbh Btstack. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the AVRCP (Audio/Video Remote Control Profile) Browsing Target component of BlueKitchen BTstack. The root cause is a failure to properly validate packet boundaries and attribute count data within the GET_FOLDER_ITEMS handler, specifically regarding the attr_id parameter. An attacker with an established Bluetooth Classic paired connection can exploit this insufficient bounds checking to trigger an out-of-bounds read. This can result in application crashes (denial of service) or corruption of the attribute bitmap state. The vulnerability is addressed in version 1.8.1.

## Affected products

- BlueKitchen BTstack < 1.8.1

## Timeline

- 2026-03-25: patched: Version 1.8.1 released
- 2026-03-30: disclosed: Initial advisory publication

## References

- [https://github.com/bluekitchen/btstack/releases/tag/v1.8.1](https://github.com/bluekitchen/btstack/releases/tag/v1.8.1)
- [https://www.vulncheck.com/advisories/bluekitchen-btstack-avrcp-browsing-target-get-folder-items-handler-oob-read-undefined-behavior](https://www.vulncheck.com/advisories/bluekitchen-btstack-avrcp-browsing-target-get-folder-items-handler-oob-read-undefined-behavior)

## Related threats

- [BlueKitchen BTstack out-of-bounds read in AVRCP Controller](https://junglewise.ai/threats/cve-2026-28527-bluekitchen-btstack-out-of-bounds-read-in-avrcp-controller)
- [BlueKitchen BTstack out-of-bounds read in AVRCP Controller](https://junglewise.ai/threats/cve-2026-28526-bluekitchen-btstack-out-of-bounds-read-in-avrcp-controller)