Alpine iLX-F511 EUVD-2026-112205

Exploitation requires the attacker to be network-adjacent to the Alpine iLX-F511 (AV:A) - i.e. within the Android Auto connection medium (wireless/USB proximity), not reachable over the open internet - and the Android Auto service must be active and reachable so that attacker-supplied data flows into the vulnerable length-unchecked stack copy. No authentication is required (PR:N) and no user interaction is assessed by ZDI (UI:N). Confirmed affected: iLX-F511 firmware 7.0.000. The primary limiting factor is the adjacency requirement, which constrains attacks to physically or wirelessly proximate adversaries rather than remote, scalable exploitation.

The CVSS 3.0 base score is 8.8 (High) driven by AV:A/AC:L/PR:N/UI:N with full C:H/I:H/A:H impact and execution as root, which is genuinely severe for any owner of an affected unit. However, the Adjacent attack vector (AV:A) is the single most important moderating signal: this is not internet-reachable remote exploitation - the attacker must be within the Android Auto connection medium (wireless/USB proximity of the head unit), which sharply limits scale and favors targeted, physical-proximity attacks over mass exploitation. No EPSS score is provided in the input, no CISA KEV listing is present, and no public exploit or PoC is indicated (the only reference is the ZDI advisory itself, which is a disclosure write-up, not working exploit code). The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious but non-emergency item. Net assessment: a real, high-severity flaw worth prompt patching for affected device owners, but the adjacency requirement plus a niche automotive product footprint mean it is unlikely to see widespread, automated exploitation; treat it as a prioritized but not emergency fix.

An attacker positioned within the Android Auto connection range of an Alpine iLX-F511 head unit sends crafted, over-length user-supplied data to the Android Auto service, which copies it into a fixed-length stack buffer without validating its length. The resulting stack-based buffer overflow lets the attacker execute arbitrary code in the context of root on the device. No authentication is required (PR:N); no public exploit code is identified at time of analysis, only the ZDI advisory.