BlueZ SBC CVE-2026-16473

Exploitation requires the attacker to be physically or logistically within Bluetooth adjacency range of the target (typically 10-100 meters). The target system must have an active Bluetooth A2DP audio session capable of receiving audio data - i.e., Bluetooth must be enabled and the A2DP sink profile must be active and accepting input from the attacker. Per CVSS PR:N, no authentication or prior pairing is required at the protocol level, though OS-level Bluetooth pairing policies may impose a practical barrier. The impact is strictly limited to reading a single heap byte; exploiting this for meaningful information disclosure would require additional knowledge of heap layout and repeated attempts. No special non-default configuration is required beyond having Bluetooth audio reception active.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N yields a score of 4.3 (Medium), which accurately reflects the bounded real-world impact. The adjacent attack vector (AV:A) limits the attacker population to Bluetooth radio range, typically 10-100 meters depending on class. The confidentiality impact is minimal: a single byte of heap memory is exposed, which may contain fragment of sensitive data but is not reliably exploitable for meaningful information extraction. There is no integrity or availability impact. No EPSS score is provided in the input data, and the vulnerability is not listed in CISA KEV. No public proof-of-concept code has been identified. SSVC signals point to low priority: exploitation is not automated at scale, technical impact is partial read-only, and the one-byte constraint severely limits exploitation utility. The primary realistic concern is as a building block in a chained local attack rather than a standalone critical flaw. CVSS and description are fully consistent - no conflicting signals detected.

An attacker within Bluetooth radio range pairs with or remains adjacent to a target system running a vulnerable version of the sbc library. The attacker streams a crafted SBC-encoded audio payload in which the frame header is manipulated to trigger the off-by-one indexing error during decoding, causing the decoder to read one byte past the allocated frame buffer into adjacent heap memory. The leaked byte is returned as part of the decoded audio output or silently consumed, potentially exposing a fragment of heap data. No public proof-of-concept exploit code has been identified at time of analysis.