BlueKitchen BTstack CVE-2026-93015

Requires an attacker within Bluetooth radio range (AV:A) who is ALREADY a bonded/paired peer of the target (PR:L) - unpaired or purely remote attackers cannot trigger this. The specific trigger is the A2DP stream endpoint discovery flow: the attacker responds to (or drives) AVDTP DISCOVER and reports more stream endpoints than the fixed table (AVDTP_MAX_SEP_NUM) holds, so the device must have A2DP enabled and be performing SEP discovery with the malicious peer. No user interaction is needed (UI:N). Limiting factors: the bonding prerequisite, Bluetooth adjacency, and A2DP being active substantially narrow the realistic attacker set; unpatched versions are BTstack through 1.8.2.

This is a moderate-priority, memory-safety availability bug rather than a high-urgency emergency. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H, score 7.0) is internally consistent with the description: exploitation requires Bluetooth adjacency (AV:A) and, critically, a *bonded* peer (PR:L) - the attacker must already be paired/trusted, which is a meaningful gate. Impact is availability-dominant (VA:H = process crash / severed A2DP event delivery) with only incidental integrity impact (VI:L from the out-of-bounds write corrupting adjacent static objects) and no confidentiality impact (VC:N). Although this is a CWE-787 out-of-bounds write, both the vendor scoring and the described fix (simply capping the endpoint count at AVDTP_MAX_SEP_NUM and discarding extras) indicate the realistic outcome is a crash of static-object corruption, not a demonstrated code-execution primitive - treat any RCE claim as unproven. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automated weaponization; the bonded-peer + adjacency prerequisites make widespread opportunistic exploitation unlikely. The signals are aligned (not conflicting): medium-high CVSS driven by a clean local availability bug, with all exploitation-probability signals absent or low. Net: patch as part of normal firmware maintenance, prioritized higher for devices that auto-bond with untrusted peripherals.

An attacker who has already bonded with a BTstack-based device (e.g., a malicious or compromised previously-paired peripheral within Bluetooth range) initiates A2DP stream endpoint discovery and returns an AVDTP DISCOVER response advertising more stream endpoints than the fixed-size table (AVDTP_MAX_SEP_NUM) can hold. The excess entries are written past the table bounds, corrupting adjacent static objects and crashing the process or breaking A2DP event delivery. No public exploit code is identified in the provided data, and the adjacent attack vector plus bonded-peer requirement limit this to attackers already within radio range and trust scope.