# CVE-2026-80185: BlueZ sdp-xml.c type confusion in RegisterProfile

Source: https://junglewise.ai/threats/cve-2026-80185-bluez-sdp-xml-c-type-confusion-in-registerprofile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80185 · Severity: medium · CVSS 5.7 · Published 2026-08-25

BlueZ is a Bluetooth protocol stack used by Linux systems to manage Bluetooth devices and connections. A type confusion vulnerability in the SDP XML parser allows a local attacker or adjacent Bluetooth peer to crash the bluetoothd daemon by sending a crafted ServiceRecord, causing a denial of service and interrupting Bluetooth functionality.

Technologies: [BlueZ](https://junglewise.ai/threats/technologies/bluez). Vendors: [BlueZ](https://junglewise.ai/threats/vendors/bluez).

## Quick answers

**Is CVE-2026-80185 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80185 being exploited in the wild.

**How severe is CVE-2026-80185?** Medium severity, with a CVSS score of 5.7, published 25 August 2026.

**Which products and versions are affected?** BlueZ 5.86 and possibly earlier.

**Is there a fix for CVE-2026-80185?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80185 attacked?** It is attacked from the adjacent network or with local access.

**Am I affected by CVE-2026-80185?** Check whether you run BlueZ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type confusion vulnerability (CWE-843) exists in BlueZ's sdp-xml.c file within the RegisterProfile() method handling. A crafted nested ServiceRecord can corrupt the SDP XML parser stack, causing scalar union data to be incorrectly treated as a sequence pointer. The vulnerability is triggered via a local caller or an adjacent Bluetooth network peer with low privileges and requires no user interaction. Exploitation results in a crash of the bluetoothd daemon (local DoS), and the parser's stack corruption could potentially allow memory read/write operations or code execution in certain configurations. Patches are available in updated BlueZ releases.

## Affected products

- BlueZ BlueZ 5.86 and possibly earlier

## Timeline

- 2026-08-25: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-80185](https://access.redhat.com/security/cve/CVE-2026-80185)

## Related threats

- [BlueZ A2DP stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-19774-bluez-a2dp-stack-based-buffer-overflow)
- [BlueZ stack-based buffer overflow in EIR handling](https://junglewise.ai/threats/cve-2026-80186-bluez-stack-based-buffer-overflow-in-eir-handling)