EUVD-2026-72777
GHSA-jjjq-73mg-45mw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
L2CAP exploitation requires Bluetooth radio proximity, making AV:A correct; DoS-only impact sets C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.
AnalysisAI
Heap-based buffer overflow in the A2DP SBC audio decoder of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows an attacker within Bluetooth range to crash the device by sending a specially crafted L2CAP packet, triggering a denial-of-service condition. The vulnerable component, a2dp_decoder_sbc.cpp, fails to validate input length before copying data onto the heap, resulting in memory corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The targeted device must be running BES2300 firmware v3.x or earlier and must be accessible over Bluetooth Classic - either actively paired with the attacker's device, in discoverable mode, or accepting unauthenticated L2CAP connections for audio profile setup. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a 7.5 base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply firmware updates issued by Bestechnic for the BES2300 SoC that address the heap overflow in a2dp_decoder_sbc.cpp. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all devices using Bestechnic BES2300 SoCs in your inventory and contact device manufacturers for patched firmware availability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today