Is CVE-2026-93015 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93015 being exploited in the wild.

How severe is CVE-2026-93015?

Medium severity, with a CVSS score of 6.3, published 17 September 2026.

Which products and versions are affected?

BlueKitchen BTstack through 1.8.2.

Is there a fix for CVE-2026-93015?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93015 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-93015?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93015: BlueKitchen BTstack A2DP endpoint discovery buffer overflow

CVE-2026-93015 · Severity: medium · CVSS 6.3 · Published 2026-09-17

BlueKitchen BTstack is a Bluetooth stack used in embedded systems and IoT devices. A vulnerability in A2DP stream endpoint discovery allows a paired Bluetooth device to send malformed discovery responses that trigger out-of-bounds memory writes, potentially corrupting system data structures and causing the application to crash or experience event delivery failures.

Quick answers

Is CVE-2026-93015 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93015 being exploited in the wild.
How severe is CVE-2026-93015?: Medium severity, with a CVSS score of 6.3, published 17 September 2026.
Which products and versions are affected?: BlueKitchen BTstack through 1.8.2.
Is there a fix for CVE-2026-93015?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93015 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-93015?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic buffer overflow in A2DP stream endpoint discovery. The vulnerable component in src/classic/a2dp.c fails to validate the peer-reported endpoint count against a fixed-size table before processing an AVDTP DISCOVER response. An attacker controlling a bonded peer device can craft a response containing more endpoints than the static table allocates, leading to out-of-bounds writes that corrupt adjacent static objects in memory. This requires prior pairing/bonding (authentication) but no further user interaction. An attacker can crash the process or disrupt Bluetooth event delivery.

Affected products

BlueKitchen BTstack through 1.8.2

Timeline

2026-09-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.