Alpine iLX-F511 EUVD-2026-112203

The attacker must be within Bluetooth radio range of the iLX-F511 and must successfully pair a malicious Bluetooth device with the target (the UI:R interaction requirement), after which a crafted message is sent to the vulnerable RFCOMM control-channel handler prh_rfcomm_cc_process_test. No authentication is required (PR:N). Limiting factors that reduce realistic risk: physical Bluetooth proximity (AV:A, not remote/internet-reachable), the dependency on completing pairing with the victim unit, the confinement to firmware version iLX-F511 7.0.000, and the fact that the primitive alone only leaks limited memory (C:L) - arbitrary code execution as root requires chaining with additional, separate vulnerabilities.

Real-world risk is LOW and the 'monitor' decision label is appropriate. The CVSS 3.0 base score is 3.5 with vector AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N: exploitation is constrained to Bluetooth adjacency (AV:A), requires user/victim interaction in the form of pairing a malicious device (UI:R), and on its own yields only a low-confidentiality memory read (C:L) with no integrity or availability impact. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and there is no public exploit identified at time of analysis - the sole reference is the ZDI advisory (ZDI-26-826), which is an advisory, not verified working exploit code. The one factor that elevates concern above the raw score is that ZDI states the OOB read can be chained with other vulnerabilities to execute arbitrary code as root; however, that outcome depends on additional, unspecified flaws and is not independently confirmed here. Net: this is a genuinely low-severity, proximity- and interaction-gated information disclosure that matters mainly as a potential link in a larger exploit chain, not a standalone priority.

An attacker within Bluetooth range induces the iLX-F511 head unit to pair with a malicious Bluetooth device, then sends a crafted RFCOMM control-channel test message that reaches prh_rfcomm_cc_process_test, where missing validation of attacker-supplied data causes a read past the end of an allocated buffer and leaks adjacent memory contents. On its own this discloses low-sensitivity information; ZDI notes it could be combined with other vulnerabilities to achieve code execution as root. No verified public exploit exists - only the ZDI advisory.