Executive brief
BlueKitchen BTstack is a Bluetooth stack used in embedded systems and IoT devices. A vulnerability in A2DP stream endpoint discovery allows a paired Bluetooth device to send malformed discovery responses that trigger out-of-bounds memory writes, potentially corrupting system data structures and causing the application to crash or experience event delivery failures.
Technical details
The vulnerability is a classic buffer overflow in A2DP stream endpoint discovery. The vulnerable component in src/classic/a2dp.c fails to validate the peer-reported endpoint count against a fixed-size table before processing an AVDTP DISCOVER response. An attacker controlling a bonded peer device can craft a response containing more endpoints than the static table allocates, leading to out-of-bounds writes that corrupt adjacent static objects in memory. This requires prior pairing/bonding (authentication) but no further user interaction. An attacker can crash the process or disrupt Bluetooth event delivery.
Affected products
- BlueKitchen BTstack through 1.8.2
Timeline
- 2026-09-17: disclosed