Alpine iLX-F511 CVE-2026-118605

The attacker must be within Bluetooth radio range of the Alpine iLX-F511 (AV:A) and must first obtain the ability to pair a malicious Bluetooth device with the target, which requires user/operator interaction to establish or accept the pairing (UI:R). Once paired, the attacker sends crafted data to the SDP service search decode path (prh_sdp_service_search_decode) where the length of user-supplied data is not validated before being copied to a stack buffer. Limiting factors: physical Bluetooth proximity, the requirement to successfully pair, and the required user interaction - exploitation is not remotely reachable over the internet and is not automatable at scale. No special non-default configuration is stated as required; affected version per EUVD is iLX-F511 7.0.000.

This is a genuine high-severity issue but not a drop-everything emergency, and the signals are largely consistent. The CVSS 3.0 vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.0) describes a network-adjacent, low-complexity flaw yielding full confidentiality, integrity and availability impact - consistent with the description's claim of arbitrary code execution as root. The vuln.today priority of 'this_week' aligns with a serious-but-not-immediate posture. No EPSS score, no CISA KEV listing, and no verified exploit code are provided in the input, so there is no evidence of active exploitation or mass scanning. The practical risk is bounded by the attack preconditions: AV:A means the attacker must be within Bluetooth range, and the description states the attacker must first obtain the ability to pair a malicious Bluetooth device - reflected in UI:R (the target/operator must participate in or accept pairing). That makes this far more suited to targeted, proximity-based attacks (e.g., against a specific vehicle/head unit) than to widespread, automatable exploitation. The product itself is an automotive aftermarket infotainment head unit, which further limits real-world attack surface compared to a ubiquitous server component carrying the same score.

An attacker within Bluetooth range pairs a malicious Bluetooth device with the target Alpine iLX-F511 head unit, then sends a crafted SDP service search request whose over-length field is copied without validation into a stack buffer in prh_sdp_service_search_decode, overflowing it and achieving code execution as root. No verified working exploit code is identified in the input; only a ZDI advisory reference is provided. The need for Bluetooth proximity and the ability to pair makes this a targeted, close-access attack rather than a remote mass-exploitation scenario.