Description

Bluetooth HFP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-19T23:16:21.083Z",
  "pubdate": "2026-08-19T23:16:21.083Z",
  "executiveSummary": "A denial of service vulnerability exists within the Bluetooth Hands-Free Profile (HFP) protocol dissector across multiple software versions. The flaw allows an attacker to trigger an application crash, resulting in a denial of service condition affecting systems utilizing the vulnerable protocol dissector. The vulnerability impacts specific product versions including 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The risk implication is significant as it disrupts normal network analysis, monitoring, or processing capabilities relying on the affected protocol parser. Attacker capabilities are centered around causing service availability disruption through malformed input handling. Exploitation requirements involve delivering specially crafted protocol data to the vulnerable dissector component, leading to abnormal termination of the parsing process.",
  "technicalDetails": "The vulnerability resides in the Bluetooth HFP profile protocol dissector component responsible for parsing and interpreting network traffic payloads associated with the Hands-Free Profile. The root cause stems from improper input validation and memory handling during the dissection of malformed or maliciously crafted protocol data packets. Specifically, the vulnerable component fails to properly handle edge cases, unexpected field lengths, or malformed structural elements within the incoming byte stream.\nWhen a vulnerable system or application processes a specially crafted Bluetooth HFP packet, the dissector encounters parsing anomalies that trigger an unhandled exception, assertion failure, or invalid memory access. This abnormal condition directly leads to an immediate crash or segmentation fault of the host process running the dissector. Network exposure depends on the deployment context of the affected software, typically involving the processing of untrusted wireless captures, live packet streams, or remote interface data.\nThe attack flow proceeds as follows: First, the attacker generates or transmits a malicious payload formatted as a Bluetooth HFP protocol data unit. Second, the target application intercepts or ingests this payload and routes it to the HFP protocol dissector for analysis. Third, as the dissector attempts to parse the corrupted data structures, it encounters the parsing logic flaw, resulting in an immediate crash. Authentication and privilege requirements vary based on the deployment architecture, but exploitation generally requires the ability to inject or feed malicious traffic into the parsing pipeline. The post-exploitation impact is strictly confined to a denial of service, preventing legitimate packet analysis and disrupting dependent services without achieving remote code execution."
}