Description

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T15:17:12.473Z",
  "pubdate": "2026-08-18T15:17:12.473Z",
  "executiveSummary": "A vulnerability has been identified in the BlueZ Bluetooth protocol stack, specifically within the Audio/Video Remote Control Profile (AVRCP) implementation. The flaw stems from insufficient validation of packet length fields within GetFolderItems responses processed by the parse_media_element() and parse_media_folder() functions. This security weakness permits a malicious Bluetooth device within radio range to trigger an out-of-bounds memory read condition.\nSuccessful exploitation of this vulnerability results in the crash of the bluetoothd daemon, thereby inducing a Denial of Service (DoS) condition on the affected system. Furthermore, the out-of-bounds read flaw introduces the potential risk of exposing sensitive heap memory contents to the adversary. The primary risk implication is the disruption of local Bluetooth services and potential information disclosure.\nRegarding attacker capabilities and exploitation requirements, the adversary must be within physical Bluetooth proximity of the target system. Additionally, successful exploitation requires user interaction, specifically the explicit pairing action between the victim device and the malicious Bluetooth device, as the AVRCP profile communication relies on an established pairing relationship.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate parsing logic of the AVRCP implementation within BlueZ. Specifically, the functions parse_media_element() and parse_media_folder() fail to appropriately validate packet length fields supplied in GetFolderItems responses received from a remote peer. When processing these malformed responses, the parsing routines read memory outside the bounds of the allocated buffer.\nThe vulnerable component is the BlueZ bluetoothd daemon handling AVRCP protocol parsing. The attack flow begins when a malicious Bluetooth device connects and pairs with the target system, a prerequisite requiring user interaction. Once paired, the malicious device transmits a specially crafted GetFolderItems response containing manipulated packet length fields.\nUpon receiving the malicious packet, the bluetoothd daemon invokes parse_media_element() or parse_media_folder() to process the payload. Due to the lack of stringent length validation, the payload behavior dictates that the execution reads beyond the intended memory boundaries. This unauthorized memory access triggers a segmentation fault or memory corruption exception, leading directly to the crash of the bluetoothd daemon and a resultant Denial of Service.\nIn addition to the immediate crash and Denial of Service impact, the post-exploitation impact includes the potential exposure of adjacent sensitive heap memory contents that may be captured or inferred through subsequent application behavior. Network exposure is limited to the local Bluetooth radio frequency range. Authentication requirements are satisfied by the user-interactive pairing process, and no additional local privilege requirements are necessary for the malicious device to transmit the malformed AVRCP response."
}