Skip to main content

Bluez EUVDEUVD-2026-79131

| CVE-2026-19774 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-09-15 zdi GHSA-53cx-rp5p-x795
RCE Buffer Overflow Stack Overflow Bluez
7.1
CVSS 3.0 · Vendor: zdi
View

Vulnerability Assessment

Weakness
CWE
CWE-121
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Stack-based buffer overflow in the A2DP profile of the BlueZ Linux Bluetooth stack allows a network-adjacent attacker to run arbitrary code as root on a target once a malicious Bluetooth audio device has been paired with it. The flaw lies in stream endpoint (SEP) handling, where attacker-supplied capability strings are copied into fixed-size stack buffers without a length check (CWE-121), so oversized SEP data corrupts the stack in the privileged bluetoothd process. CVSS 7.1 (AV:A/AC:H/PR:N/UI:R) reflects the requirement for a paired device and radio proximity; no public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied.

Affected VersionsENISA

BlueZ b138a0849ba26310c3f40e78037565ce274d8737

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Bluez gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (zdi) PRIMARY 7.1 HIGH
AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE 8.0 HIGH
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat 8.0 HIGH

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.

Threat Intelligence Overview

EPSS Score
0.3%
Top 74% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Stack-based Buffer Overflow HIGH

A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

More in Bluez

View all
CVE-2017-1000250 MEDIUM POC
6.5 Sep 12

All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which
CVE-2019-8922 HIGH POC
8.8 Nov 29

A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. Rated high severity (CVSS 8.8), this vu
CVE-2022-0204 HIGH POC
8.8 Mar 10

A heap overflow vulnerability was found in bluez in versions prior to 5.63. Rated high severity (CVSS 8.8), this vulnera
CVE-2016-9918 HIGH POC
7.5 Dec 08

In BlueZ 5.42, an out-of-bounds read was identified in "packet_hexdump" function in "monitor/packet.c" source file. Rate
CVE-2016-9917 HIGH POC
7.5 Dec 08

In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. Rated high severity
CVE-2019-8921 MEDIUM POC
6.5 Nov 29

An issue was discovered in bluetoothd in BlueZ through 5.48. Rated medium severity (CVSS 6.5), this vulnerability is no

CVE-2021-41229 MEDIUM POC
6.5 Nov 12

BlueZ is a Bluetooth protocol stack for Linux. Rated medium severity (CVSS 6.5), this vulnerability is no authentication
CVE-2016-9798 MEDIUM POC
5.3 Dec 03

In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. Rated mediu
CVE-2016-9797 MEDIUM POC
5.3 Dec 03

In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. Rated med
CVE-2016-9802 MEDIUM POC
5.3 Dec 03

In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. Rated med
CVE-2016-9799 MEDIUM POC
5.3 Dec 03

In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. Rated medium sever
CVE-2016-9803 MEDIUM POC
5.3 Dec 03

In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. Rat

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

References

Advisories & patches
ADVISORY https://github.com/bluez/bluez/pull/2251 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-19774 ADVISORY https://ubuntu.com/security/notices/USN-8908-1 ADVISORY https://vuldb.com/vuln/394869 REF https://www.zerodayinitiative.com/advisories/ZDI-26-589/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy