Skip to main content

BlueZ SBC CVE-2026-16473

| EUVDEUVD-2026-47623 MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-22 redhat GHSA-2xmm-4jcc-wgxq
4.3
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
4.3 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
4.3 MEDIUM

Adjacent vector (Bluetooth range), no auth needed per A2DP protocol; impact is limited to one-byte read, so C:L with no integrity or availability impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 11:15 vuln.today
CVE Published
Jul 22, 2026 - 10:07 cve.org
MEDIUM 4.3

DescriptionCVE.org

A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.

AnalysisAI

Off-by-one heap out-of-bounds read in the BlueZ SBC (Sub-Band Coding) frame decoder allows a Bluetooth-adjacent unauthenticated attacker to leak a single byte of heap memory by streaming a crafted audio payload. Red Hat Enterprise Linux 7 through 10 are confirmed affected via the bundled sbc library. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Position within Bluetooth radio range
Delivery
Initiate A2DP audio stream to target
Exploit
Craft malformed SBC audio frame with off-by-one boundary condition
Execution
Trigger heap out-of-bounds read in sbc decoder
Impact
Leak one byte of adjacent heap memory

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to be physically or logistically within Bluetooth adjacency range of the target (typically 10-100 meters). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N yields a score of 4.3 (Medium), which accurately reflects the bounded real-world impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker within Bluetooth radio range pairs with or remains adjacent to a target system running a vulnerable version of the sbc library. The attacker streams a crafted SBC-encoded audio payload in which the frame header is manipulated to trigger the off-by-one indexing error during decoding, causing the decoder to read one byte past the allocated frame buffer into adjacent heap memory. …
Remediation No vendor-released patch with an exact fixed version has been identified from the available input data; the upstream sbc git repository at https://git.kernel.org/pub/scm/bluetooth/sbc.git should be monitored for a tagged fix release. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-59851 HIGH
8.8 Jul 21

Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi

Vendor StatusVendor

Share

CVE-2026-16473 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy