Description

Bluetooth Attribute Protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-19T23:16:19.070Z",
  "pubdate": "2026-08-19T23:16:19.070Z",
  "executiveSummary": "This vulnerability involves a denial of service condition stemming from a crash within the Bluetooth Attribute Protocol dissector.\nThe flaw allows an attacker to cause application termination or system unresponsiveness by supplying malformed or maliciously crafted protocol data.\nThe affected products include specific version ranges of the software handling the Bluetooth Attribute Protocol, specifically versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18.\nThe risk implication is a complete loss of availability for the affected packet analysis or processing service, potentially disrupting monitoring capabilities or dependent communication stacks.\nAttacker capabilities are focused on disruption rather than execution, requiring the ability to transmit or inject crafted Bluetooth Attribute Protocol traffic into the parsing engine.\nExploitation requirements typically involve network proximity or access to the packet ingestion stream where the vulnerable dissector processes incoming Bluetooth traffic.",
  "technicalDetails": "The root cause of this vulnerability lies in inadequate input validation and error handling within the Bluetooth Attribute Protocol dissector component.\nWhen processing malformed, truncated, or otherwise unexpected attribute protocol packets, the dissector fails to safely handle anomalous data structures, resulting in a memory access violation, assertion failure, or null pointer dereference that triggers an application crash.\nThe vulnerable component is explicitly the Bluetooth Attribute Protocol dissector module spanning software versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18.\nExploitation occurs when an adversarial entity transmits a specially crafted Bluetooth Attribute Protocol packet across the network or data link layer into the ingestion path monitored or processed by the vulnerable software.\nAs the parsing engine attempts to traverse and decode the malicious payload fields within the dissector, the parsing logic encounters the flaw, leading to an unhandled exception.\nThis halts the execution flow of the target process, precipitating a denial of service condition for any service relying on the dissector for packet analysis or protocol decoding.\nAuthentication and privilege requirements depend on the deployment context, but network exposure of the Bluetooth parsing interface is generally required for an external actor to deliver the malicious payload.\nNo post-exploitation impact beyond the initial denial of service is indicated, as the vulnerability is strictly characterized as a dissector crash rather than a remote code execution vector."
}