Description

Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-19T23:16:20.960Z",
  "pubdate": "2026-08-19T23:16:20.960Z",
  "executiveSummary": "A denial of service vulnerability exists within the Bluetooth BR/EDR FHS protocol dissector, impacting versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The flaw is triggered when the affected software processes a malformed Bluetooth BR/EDR Frequency Hop Synchronization (FHS) packet, resulting in a protocol dissector crash. This condition leads to an application termination or disruption in packet analysis workflows, preventing the legitimate processing of network traffic.\nThe risk implication is primarily operational disruption, as an attacker capable of injecting or transmitting malicious packet data into the parsing pipeline can repeatedly crash the affected parser, halting monitoring or processing capabilities. The vulnerability affects systems running the vulnerable software versions exposed to untrusted Bluetooth traffic streams. Exploitation relies on the ingestion of specifically crafted protocol data structures designed to violate parser expectations, thereby triggering a fatal exception within the dissector component without requiring elevated privileges or prior authentication if the parsing engine is exposed to raw or unvalidated input streams.",
  "technicalDetails": "The vulnerability resides in the Bluetooth BR/EDR FHS (Frequency Hop Synchronization) protocol dissector component of the affected software versions (4.6.0 through 4.6.7 and 4.4.0 through 4.4.18). The root cause stems from improper validation and handling of malformed packet structures within the protocol parsing logic, which fails to safely manage unexpected field values, boundary conditions, or structural anomalies inherent in the incoming byte stream.\nThe attack flow begins when an adversarial or malformed Bluetooth BR/EDR FHS packet is introduced into the parsing environment. As the vulnerable dissector attempts to unpack, decode, and analyze the packet headers or payload elements, it encounters unexpected data patterns that violate internal assumptions regarding structural integrity or length constraints. Because the code lacks adequate bounds checking, null pointer validation, or exception handling mechanisms, the parsing routine triggers an unhandled memory fault, assertion failure, or segmentation fault.\nThis behavior results in the immediate abnormal termination of the parsing process or the host application executing the dissector. Network exposure is contingent upon the component processing untrusted or unvalidated network captures, live radio frequency data, or external packet streams. No authentication or privilege requirements are strictly necessary to induce the crash, provided the target system processes the maliciously crafted FHS packet payload through the vulnerable dissector. The post-exploitation impact is strictly confined to denial of service through application crashes, as remote code execution is generally not facilitated by this specific type of parsing fault."
}