EUVD-2026-112205
GHSA-rvhh-8qcx-952m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network-adjacent position to unit
-
DeliverySend oversized Android Auto data
-
ExploitOverflow fixed-length stack buffer
-
ExecutionExecute injected code as root
-
ImpactFull head-unit compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be network-adjacent to the Alpine iLX-F511 (AV:A) - i.e. within the Android Auto connection medium (wireless/USB proximity), not reachable over the open internet - and the Android Auto service must be active and reachable so that attacker-supplied data flows into the vulnerable length-unchecked stack copy. No authentication is required (PR:N) and no user interaction is assessed by ZDI (UI:N). Confirmed affected: iLX-F511 firmware 7.0.000. The primary limiting factor is the adjacency requirement, which constrains attacks to physically or wirelessly proximate adversaries rather than remote, scalable exploitation. |
| Impact | The CVSS 3.0 base score is 8.8 (High) driven by AV:A/AC:L/PR:N/UI:N with full C:H/I:H/A:H impact and execution as root, which is genuinely severe for any owner of an affected unit. However, the Adjacent attack vector (AV:A) is the single most important moderating signal: this is not internet-reachable remote exploitation - the attacker must be within the Android Auto connection medium (wireless/USB proximity of the head unit), which sharply limits scale and favors targeted, physical-proximity attacks over mass exploitation. No EPSS score is provided in the input, no CISA KEV listing is present, and no public exploit or PoC is indicated (the only reference is the ZDI advisory itself, which is a disclosure write-up, not working exploit code). The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious but non-emergency item. Net assessment: a real, high-severity flaw worth prompt patching for affected device owners, but the adjacency requirement plus a niche automotive product footprint mean it is unlikely to see widespread, automated exploitation; treat it as a prioritized but not emergency fix. |
| Exploit ScenarioDerived | An attacker positioned within the Android Auto connection range of an Alpine iLX-F511 head unit sends crafted, over-length user-supplied data to the Android Auto service, which copies it into a fixed-length stack buffer without validating its length. The resulting stack-based buffer overflow lets the attacker execute arbitrary code in the context of root on the device. No authentication is required (PR:N); no public exploit code is identified at time of analysis, only the ZDI advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A stack-based buffer overflow in the Android Auto service on Alpine iLX-F511 head units lets network-adjacent attackers run arbitrary code as root without authentication or user interaction. The flaw is an unchecked length on user-supplied data copied into a fixed-length stack buffer (CWE-121), rated CVSS 8.8 High (AV:A/AC:L/PR:N/UI:N, C/H/I/H/A:H); successful exploitation grants full control of the device in the root context. Confirmed affected firmware is iLX-F511 7.0.000 per ENISA EUVD-2026-112205; no public exploit code and no CISA KEV listing were identified at time of analysis, and the practical constraint is that an attacker must be within the Android Auto connection range (wireless or USB proximity) rather than able to reach the unit over the open internet.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available data; the ZDI advisory ZDI-26-828 (https://www.zerodayinitiative.com/advisories/ZDI-26-828/) and ENISA EUVD-2026-112205 are the tracking references to monitor for an Alpine firmware update covering iLX-F511 7.0.000. Until a fix is published, the controls that follow from the assessed exploitation conditions are proximity and attack-surface reduction: because the vector is AV:A and the Android Auto service must be active and reachable for attacker-supplied data to reach the vulnerable stack copy, keep the head unit physically secured so unknown parties cannot establish wireless or USB proximity, and disable or disconnect Android Auto functionality (both wireless and wired) when it is not in use - the trade-off is loss of Android Auto features for as long as the service is disabled. These measures reduce exposure but do not remove the underlying missing length check, so they should be lifted only once an Alpine firmware update is available and applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic stack-based buffer overflow (CWE-121) in the Android Auto service component of the Alpine iLX-F511 in-vehicle head unit. Per the ZDI advisory (ZDI-26-828, ZDI-CAN-29015), the service fails to validate the length of attacker-supplied data before copying it into a fixed-length buffer allocated on the stack, so an oversized input can overwrite adjacent stack memory and redirect execution. Because the Android Auto service runs with elevated privileges, code execution lands in the root context, giving an attacker full control of the head unit rather than a sandboxed or user-level foothold. The CVSS vector CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (independently re-assessed as CVSS 3.1 with an identical vector) reflects a low-complexity, unauthenticated attack that is only reachable from an adjacent network segment - in this deployment that means the Android Auto connection medium (wireless or USB proximity) - with no user interaction required. The supplied sources do not describe the precise packet or message parsing path that triggers the overflow; only the missing length check and the resulting stack copy are documented. The CPE entry cpe:2.3:a:alpine:ilx-f511:*:*:*:*:*:*:*:* carries a wildcard version, so the CPE alone does not bound affected releases, while EUVD explicitly lists firmware 7.0.000 as affected.
Know when Ilx F511 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker must be adjacent via the Android Auto medium (AV:A) with no auth or interaction (PR:N/UI:N); unchecked copy is reliably triggerable (AC:L) and yields root, so C/I/A all High.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
DescriptionCVE.org
Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Android Auto service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29015.
Executive ViewAI
A high-severity vulnerability in the Alpine iLX-F511 in-vehicle head unit allows attackers within wireless or USB proximity to execute arbitrary code as root, potentially granting full control of the device. This affects all vehicles using the confirmed firmware version 7.0.000 and could compromise vehicle infotainment integrity and any connected mobile devices or data. Leadership should prioritize mitigation because exploitation requires no authentication or user interaction and could lead to unauthorized access to sensitive vehicle systems or data.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling wireless Android Auto, restricting physical access to USB ports, and monitoring for anomalous infotainment behavior.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in the framework service of the Alpine iLX-F511 infotainment head unit allows network-adjacent att
A stack-based buffer overflow in the prh_sdp_service_search_decode function of the Alpine iLX-F511 in-vehicle head unit
A stack-based buffer overflow in the vCard parser of the Alpine iLX-F511 in-dash multimedia receiver (build 7.0.0000) le
Local privilege escalation in the Alpine iLX-F511 in-vehicle media receiver lets code already running as a low-privilege
A heap-based buffer overflow in the Bluetooth OBEX packet handling of the Alpine iLX-F511 in-car head unit (version 7.0.
Unauthenticated code execution as root on Alpine iLX-F511 in-car head units (version 7.0.000) is possible because the An
Command injection in the 'diagapp' diagnostic component of the Alpine iLX-F511 in-dash infotainment head unit lets a phy
Stack-based buffer overflow in the framework service of the Alpine iLX-F511 in-vehicle head unit allows an attacker with
Hard-coded SSH credentials in Alpine iLX-F511 firmware 7.0.000 allow network-adjacent, unauthenticated attackers to log
An out-of-bounds read in the Bluetooth RFCOMM control-channel handler prh_rfcomm_cc_process_test (inside libanwbtstack.s
Exploit-DB