Is CVE-2026-79378 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79378 being exploited in the wild.

How severe is CVE-2026-79378?

High severity, with a CVSS score of 7.5, published 8 September 2026.

Which products and versions are affected?

Bestechnic BES2300 v3.x and earlier.

Is there a fix for CVE-2026-79378?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-79378 attacked?

It is attacked from the adjacent network, in device firmware.

Am I affected by CVE-2026-79378?

Check whether you run Bestechnic BES2300 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79378: Bestechnic BES2300 Bluetooth SoC denial of service in L2CAP handler

CVE-2026-79378 · Severity: high · CVSS 7.5 · Published 2026-09-08

Bestechnic's BES2300 is a Bluetooth Audio System-on-Chip used in wireless audio devices such as earbuds and headphones. A vulnerability in the firmware's L2CAP (Logical Link Control and Adaptation Protocol) handler allows an attacker within Bluetooth range to crash the device or temporarily disable its audio functionality by sending a specially crafted packet, causing service disruption for users.

Technologies: Bestechnic BES2300. Vendors: Bestechnic.

Quick answers

Is CVE-2026-79378 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79378 being exploited in the wild.
How severe is CVE-2026-79378?: High severity, with a CVSS score of 7.5, published 8 September 2026.
Which products and versions are affected?: Bestechnic BES2300 v3.x and earlier.
Is there a fix for CVE-2026-79378?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79378 attacked?: It is attacked from the adjacent network, in device firmware.
Am I affected by CVE-2026-79378?: Check whether you run Bestechnic BES2300 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the btm_acl_handle() function of BES2300 firmware v3.x and earlier, which processes Bluetooth L2CAP packets. An attacker can send a crafted L2CAP packet over the Bluetooth network that triggers an unhandled error condition, causing a denial of service (crash or hang). The attack requires Bluetooth network proximity but no authentication or user interaction. This affects the availability of Bluetooth audio services on affected devices.

Affected products

Bestechnic BES2300 v3.x and earlier

Timeline

2026-09-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.