BlueZ EUVD-2026-66134

Exploitation requires a local, low-privilege account on the target Linux system with D-Bus access sufficient to call the bluetoothd RegisterProfile() method - confirmed by CVSS PR:L. The crafted ServiceRecord must contain specifically nested XML structures that corrupt the SDP parser stack; no Bluetooth radio proximity to the target is needed, as the attack is entirely through local IPC. Limiting factors: the attacker cannot be fully remote; they must have an authenticated local session. The impact is limited to a bluetoothd process crash (availability only, S:U). No special non-default configuration is documented as required, but D-Bus policy restrictions or sandboxing would block the attack even for authenticated local users.

The NVD-assigned CVSS 3.1 score of 5.7 Medium (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) overstates the network adjacency of the attack surface: the attack path goes through the local D-Bus IPC interface, not over a Bluetooth radio link, which aligns better with AV:L rather than AV:A. Regardless of vector interpretation, the real-world risk is constrained: exploitation requires an attacker who already has local, low-privilege authenticated access and can make D-Bus calls targeting bluetoothd. The impact ceiling is a daemon crash - service disruption, not code execution or data exfiltration. No EPSS score was supplied in the input data. No KEV listing exists, and no POC code has been identified, making opportunistic mass exploitation unlikely. The primary concern is in environments where Bluetooth availability is operationally critical (e.g., embedded Linux devices, kiosks, medical hardware) or where an unprivileged local attacker seeks to disrupt a higher-privilege service. For general server or desktop Linux, this is a low-priority issue unless untrusted local users have D-Bus access.

A low-privileged local user on a Linux system calls bluetoothd's RegisterProfile() D-Bus method with a specially constructed nested ServiceRecord XML payload. The malformed nesting causes the SDP XML parser in sdp-xml.c to corrupt its internal stack and misinterpret a scalar union value as a sequence pointer. On the next dereference, bluetoothd crashes, terminating Bluetooth service for all users until the daemon is restarted. No public exploit code has been identified at time of analysis.