Alpine iLX-F511 CVE-2026-118611

Exploitation requires Bluetooth-OBEX proximity to the Alpine iLX-F511 head unit (CVSS AV:P / 'physically present attackers'): the attacker must be within Bluetooth range of a device that is discoverable/pairable and reachable over the OBEX profile, then send an OBEX packet carrying user-supplied data longer than the device validates before copying it into a heap buffer. No authentication (PR:N) and no user interaction (UI:N) are needed once in range. The primary limiting factor is the physical/proximity access requirement - there is no network-remote path - which prevents large-scale remote exploitation; affected version per EUVD is iLX-F511 7.0.000.

The decisive mitigating signal is the CVSS attack vector AV:P (physical), reflected in the description's explicit 'physically present attackers' language: exploitation requires Bluetooth-OBEX proximity to the target Alpine iLX-F511 head unit, not remote internet reach, which is why the base score lands at only 6.8 despite C:H/I:H/A:H and code execution as root. Per CVSS the flaw is unauthenticated (PR:N) with low complexity (AC:L) and no user interaction (UI:N), so an attacker within Bluetooth range of a reachable/pairable device faces few obstacles. No EPSS probability was provided, the vulnerability is NOT on the CISA KEV list, and no public exploit was identified - only the ZDI advisory reference, which is not exploit code. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a serious but physically-gated issue. Net: this is a genuine high-impact RCE (root) but the physical/proximity access requirement sharply limits real-world mass exploitation; treat it as a prioritized patch item for affected fleets, not a drop-everything emergency. Note: the term 'remote code execution' in the title conflicts with the AV:P physical vector and the 'physically present attackers' wording - the realistic access model is Bluetooth proximity, not network-remote; verify range/pairing prerequisites with the vendor.

An attacker within Bluetooth range of a targeted Alpine iLX-F511 in-vehicle head unit connects via OBEX and sends a crafted packet whose user-supplied data exceeds the length the device validates, overflowing a heap buffer. Because the vulnerable code runs as root and no authentication is required, successful exploitation yields arbitrary code execution with full privileges on the device. No public proof-of-concept or exploit code was identified at the time of analysis.