EUVD-2026-112197
GHSA-v5x4-3j8x-2pgq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to iLX-F511 unit
-
DeliverySupply oversized input to framework service
-
ExploitOverflow fixed-length stack buffer
-
ExecutionHijack control flow
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires physical access to an Alpine iLX-F511 device (CVSS AV:P) running affected firmware iLX-F511 7.0.000; the attacker must be able to deliver user-supplied data to the device's framework service. No authentication is required (PR:N) and no user interaction is needed (UI:N), and complexity is low (AC:L) once physical access is achieved. The decisive limiting factor is the physical-presence requirement: the flaw is not remotely reachable over a network, so realistic exploitation is confined to hands-on access to the head unit (e.g., in a vehicle an attacker can physically reach). |
| Impact | This is a genuine root-level remote code execution flaw, but its real-world urgency is tempered by the physical attack vector. The CVSS 3.0 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 6.8 (Medium) specifically because exploitation requires physical presence at the device (AV:P), even though it needs no authentication (PR:N), no user interaction (UI:N), and is low-complexity (AC:L) once physical access is obtained, yielding full confidentiality, integrity, and availability compromise as root. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no signal of widespread or active exploitation. No public exploit was identified; only a ZDI advisory reference is supplied. The vuln.today decision label is 'this_month' - a real priority to patch but not an emergency. The physical-access requirement is the dominant limiting factor: this is not internet-exploitable and realistically concerns scenarios where an attacker has hands-on access to the specific head unit (e.g., a serviced, shared, or targeted vehicle), making it a targeted rather than mass-exploitation risk. All signals are internally consistent here; the medium CVSS, absent KEV/EPSS, and 'this_month' label align rather than conflict. |
| Exploit ScenarioDerived | An attacker with physical access to an Alpine iLX-F511 in-vehicle head unit supplies overly long user data to the framework service, overflowing a fixed-length stack buffer because the input length is not validated. This overwrites the stack and lets the attacker execute arbitrary code as root on the device. No working public exploit code is confirmed; only the ZDI advisory reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Stack-based buffer overflow in the framework service of the Alpine iLX-F511 in-vehicle head unit allows an attacker with hands-on access to the device to execute arbitrary code as root. Only firmware version 7.0.000 is identified as affected, and no authentication or user interaction is required once the attacker can reach the service, which keeps the CVSS complexity low. The physical attack vector (AV:P) is the decisive constraint: the flaw is not network-reachable, EPSS and CISA KEV data provided do not indicate active exploitation, and no public exploit code has been identified at time of analysis. Reported by ZDI as ZDI-CAN-29007 / ZDI-26-822 and tracked in ENISA EUVD as EUVD-2026-112197.
RemediationAI
No vendor-released fixed firmware version is identified in the available data; the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-822/ is the reference to monitor for Alpine's remediation guidance and any patched firmware release for iLX-F511 7.0.000. Because the attack vector is physical (AV:P), the only compensating control the evidence supports is limiting hands-on access to the head unit - keeping the vehicle secured, restricting who can pair devices or interact with the unit's service interfaces, and treating loaner, resale and fleet vehicles as untrusted until firmware status is confirmed. The trade-off is operational: these measures reduce exposure to a physically present attacker but do not remove the underlying missing length check, and owners remain dependent on Alpine shipping patched firmware. Remediation timelines should follow the assessed this_month priority rather than emergency handling, since exploitation requires direct physical contact with the device.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow in the device's framework service, a privileged component of the Alpine iLX-F511 firmware. The defect is the absence of length validation on user-supplied data before it is copied into a fixed-length stack buffer, so an over-long input can overwrite adjacent stack memory and, per the advisory, redirect execution in the context of root. The CPE cpe:2.3:a:alpine:ilx-f511 with a wildcard version confirms the product-level scope, while the ENISA EUVD record narrows the known affected build to iLX-F511 7.0.000; whether other firmware builds carry the same code path is not stated in the available data. The specific input channel and service entry point used to reach the vulnerable copy are not described in the sources, so the trigger mechanics beyond the missing length check remain unverified. The CVSS vector AV:P/AC:L/PR:N/UI:N places the exploit firmly in the physical-access domain - the attacker must be able to deliver data to the head unit locally, but faces no authentication or interaction barrier afterwards.
Know when Ilx F511 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical access to the head unit drives AV:P; no auth or interaction needed (PR:N/UI:N) with low complexity (AC:L), and root-level code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
DescriptionCVE.org
Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the framework service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29007.
Zero Day Initiative Advisories
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
A stack-based buffer overflow in the Android Auto service on Alpine iLX-F511 head units lets network-adjacent attackers
Remote code execution in the framework service of the Alpine iLX-F511 infotainment head unit allows network-adjacent att
A stack-based buffer overflow in the prh_sdp_service_search_decode function of the Alpine iLX-F511 in-vehicle head unit
A stack-based buffer overflow in the vCard parser of the Alpine iLX-F511 in-dash multimedia receiver (build 7.0.0000) le
Local privilege escalation in the Alpine iLX-F511 in-vehicle media receiver lets code already running as a low-privilege
A heap-based buffer overflow in the Bluetooth OBEX packet handling of the Alpine iLX-F511 in-car head unit (version 7.0.
Unauthenticated code execution as root on Alpine iLX-F511 in-car head units (version 7.0.000) is possible because the An
Command injection in the 'diagapp' diagnostic component of the Alpine iLX-F511 in-dash infotainment head unit lets a phy
Hard-coded SSH credentials in Alpine iLX-F511 firmware 7.0.000 allow network-adjacent, unauthenticated attackers to log
An out-of-bounds read in the Bluetooth RFCOMM control-channel handler prh_rfcomm_cc_process_test (inside libanwbtstack.s
Exploit-DB