EUVD-2026-66133
GHSA-f784-6479-v89p
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
AV:A reflects Bluetooth range constraint; PR:N and UI:N because active discovery mode alone is sufficient, requiring no victim authentication or explicit action.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
AnalysisAI
Stack-based buffer overflow in BlueZ, the Linux Bluetooth protocol stack, allows any unauthenticated attacker within Bluetooth radio range to crash the bluetoothd service and potentially execute arbitrary code. The flaw is triggered when a target device with Bluetooth discovery enabled processes a malicious Extended Inquiry Response (EIR) packet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Bluetooth discovery must be active on the victim device - this is the standard mode required for device pairing and is frequently enabled by default on consumer laptops and IoT hardware. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:A correctly constrains exploitation to Bluetooth radio range (typically 10-100 meters for Class 1/2 devices), meaningfully narrowing the opportunistic attack surface compared to internet-facing vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positions themselves within Bluetooth radio range of a target Linux system running BlueZ with Bluetooth discovery active. The attacker transmits a crafted EIR packet containing an oversized field value during device inquiry, triggering the stack buffer overflow in bluetoothd. … |
| Remediation | The primary fix is to apply the patch referenced in the BlueZ upstream GitHub Security Advisory (https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975) and the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-80186). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems with Bluetooth enabled across your infrastructure and assess which are exposed to untrusted wireless environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today