Alpine iLX-F511 EUVD-2026-112196

Exploitation requires the attacker to be within Bluetooth (adjacent-network, AV:A) range and requires active user interaction: the victim must initiate a connection from the iLX-F511 to the attacker's malicious Bluetooth device, after which a crafted vCard is parsed. No authentication is needed (PR:N). The vulnerable code path is vCard parsing - i.e., contact/address-book data exchanged over the Bluetooth connection. Limiting factors that reduce real-world risk: the attacker cannot reach the device over the internet or standard IP networks (proximity-bound), and no exploitation occurs unless the user actively connects to the malicious device; the affected build is iLX-F511 7.0.0000. No non-default configuration is called out as a prerequisite in the available sources.

This is a genuinely serious flaw but with naturally constrained reach, so it is a priority to patch rather than a widespread-exploitation emergency. The CVSS 3.0 vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.0 High) confirms unauthenticated (PR:N), low-complexity exploitation yielding full confidentiality, integrity and availability loss - consistent with the description's claim of arbitrary code execution as root. The limiting signals are the adjacent-network vector (AV:A, Bluetooth range only) and required user interaction (UI:R, the victim must connect to the attacker's malicious Bluetooth device), which prevent remote, hands-off mass exploitation. No EPSS score, no CISA KEV listing, and no verified exploit code are present in the input; the sole reference is the ZDI advisory itself. The vuln.today priority is 'this_week' (not act_now/emergency), aligning with a high-impact but interaction-gated, proximity-limited issue. In short: a real, root-level RCE worth prompt remediation, but not evidence of active or automatable widespread exploitation.

An attacker within Bluetooth range sets up a malicious device and induces the victim to pair/connect their Alpine iLX-F511 head unit to it; the device then sends a crafted vCard whose over-long field overflows a fixed-length stack buffer during parsing, giving the attacker code execution as root on the unit. No public, verified exploit code is identified in the input - only the ZDI advisory reference. The adjacent-only vector and required user connection keep this to targeted, close-proximity attacks rather than remote mass exploitation.