Alpine iLX-F511 CVE-2026-118609

Exploitation requires physical presence at the Alpine iLX-F511 head unit (CVSS AV:P): the attacker must connect to the device's Android Auto connection handler - typically via a wired/USB Android Auto session - and supply over-length data that the handler copies into a fixed-length stack buffer without length validation. No authentication is required (PR:N) and no user interaction by a legitimate user is needed (UI:N), and the affected version is iLX-F511 7.0.000. The dominant limiting factor is the physical-access precondition: the attacker must have hands-on or local wired access to the unit, which prevents remote or network-based exploitation and constrains realistic abuse to scenarios where the vehicle/head unit is physically accessible to an untrusted party.

This is a genuinely high-severity vulnerability in mechanism (unauthenticated root code execution via a classic stack-based buffer overflow, CWE-121) but a moderate real-world priority because of the physical attack vector. The CVSS:3.0 vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (6.8, Medium) explicitly scopes exploitation to a physically present attacker: the C:H/I:H/A:H impact and root-context execution are severe, but AV:P caps the base score and reflects that remote mass-exploitation is not possible. No EPSS score was provided, no CISA KEV listing is present, and there is no confirmed public exploit code - only the ZDI advisory reference - so there are no signals of active or at-scale exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a serious but non-emergency, physically-gated bug. The signals are internally consistent rather than conflicting: a high technical impact bounded by a physical-access precondition. The main caveat is that AV:P requires the attacker to physically interact with the head unit, so prioritization should weigh exposure of the device to untrusted physical/USB access rather than treating this as an internet-facing RCE.

An attacker with physical access to a vehicle (e.g., valet, rental return, repair shop, or a briefly unattended car) connects a malicious device emulating an Android Auto phone to the Alpine iLX-F511 head unit. The connection handler copies attacker-controlled data of unchecked length into a fixed-size stack buffer, overflowing it and allowing arbitrary code execution as root. No public exploit code is identified at time of analysis; only the ZDI advisory documents the flaw.