EUVD-2026-90456
GHSA-r27r-cp4v-gw48
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain Bluetooth-adjacent position
-
DeliveryEstablish A2DP source connection to victim sink
-
ExploitNegotiate LC3plus session
-
ExecutionSend RTP media header with frame_count=0
-
PersistTrigger divide-by-zero (SIGFPE) in decoder thread
-
ImpactCrash bluealsad daemon (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Division safety checks
|
| Exploitation Conditions | Exploitation requires: (1) the victim running bluealsad compiled with LC3plus decoder support enabled - a non-default build-time option, so unaffected builds are simply not vulnerable; (2) bluealsad operating in A2DP sink mode; (3) the attacker within Bluetooth-adjacent range (AV:A) able to establish an A2DP source connection and negotiate an LC3plus session (PR:L / AT:P). Given those, the attacker sends a single non-fragmented LC3plus RTP media header with the frame count field set to 0 to trigger the SIGFPE. Limiting factors: physical Bluetooth proximity, the optional LC3plus build flag, an established/negotiated session, and impact limited to a daemon crash (restartable) rather than code execution or data exposure. |
| Impact | This is a low-priority availability issue, and the signals are internally consistent in that direction. The CVSS 4.0 base score is 2.1, reflecting a constrained attack: AV:A (Bluetooth-adjacent, not network-remote), AT:P (an attack requirement - the victim build must be compiled with LC3plus support and an LC3plus A2DP session must be negotiated), and PR:L (the attacker must establish an A2DP source connection to the victim sink). There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis. One internal conflict worth flagging: the vendor vector encodes impact as VI:L/VA:N, but the described effect is a SIGFPE crash of the bluealsad daemon - that is an availability impact, so VA (not VI) should carry the weight; the integrity flag appears mislabeled. Net: a genuine, patched divide-by-zero DoS, but gated behind physical proximity, a non-default build flag, and an established Bluetooth session, making real-world urgency low. |
| Exploit ScenarioDerived | An attacker within Bluetooth range of a device running bluealsad as an A2DP sink (e.g., a Linux speaker/embedded audio appliance) establishes an A2DP source connection and negotiates an LC3plus session. The attacker then transmits a single non-fragmented LC3plus RTP media header whose frame count field is set to zero, triggering a division-by-zero (SIGFPE) in the decoding thread and crashing the daemon. No public exploit code is identified, but the root cause and fix are fully disclosed in the vendor patch commit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
BlueALSA's LC3plus A2DP sink decoder uses an attacker-supplied RTP frame count as a divisor without validating it, so a single non-fragmented LC3plus media header carrying a frame count of zero causes a SIGFPE that terminates the bluealsad daemon. Only builds compiled with the optional LC3plus decoder support are affected, and only when bluealsad acts as an A2DP sink; the attacker must be within Bluetooth-adjacent range and able to establish an A2DP source connection that negotiates an LC3plus session (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Impact is limited to a restartable daemon crash - no code execution, data exposure, or integrity loss beyond the availability hit - and no public exploit code was identified at time of analysis.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - update BlueALSA to a build that includes commit 1a84465dd860d1be9dcf62339c6273e9e0632dd2, which adds a zero-frame-count guard in a2dp_lc3plus_dec_thread() and drops the malformed payload instead of dividing by zero (see https://github.com/arkq/bluez-alsa/commit/1a84465dd860d1be9dcf62339c6273e9e0632dd2 and https://www.vulncheck.com/advisories/bluealsa-bluealsad-lc3plus-decoder-division-by-zero-dos). If immediate patching is not possible, the most effective compensating control is to rebuild bluealsad without the optional LC3plus decoder support, which removes the vulnerable code path entirely; the trade-off is loss of LC3plus A2DP playback (standard SBC/AAC/aptX codecs are unaffected), and this only helps environments that do not require LC3plus. Avoid running the daemon in A2DP sink mode on untrusted or public Bluetooth environments, since the prerequisite is an established A2DP source connection from a Bluetooth-adjacent peer, but note that this is a functional restriction rather than a reliable security boundary. Where sink mode must remain enabled, supervise bluealsad with an auto-restart unit so that a SIGFPE crash is recovered quickly, accept the transient audio outage, and monitor logs for the pre-patch crash signature; there is no authentication or configuration toggle that reliably blocks the crafted RTP media header once an LC3plus session has been negotiated.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BlueALSA (arkq/bluez-alsa, CPE cpe:2.3:a:arkq:bluez-alsa:*:*:*:*:*:*:*:*) is a Bluetooth audio backend that implements A2DP, the Bluetooth profile used to stream audio, and carries encoded audio frames in RTP. The vulnerable path is a2dp_lc3plus_dec_thread() in src/a2dp-lc3plus.c, which decodes the LC3plus codec - an optional, build-time-enabled extension of the LC3 codec. Per the upstream commit diff, the decoder reads rtp_media_header->frame_count and derives per-frame payload sizing from it; because the pre-patch code assumed a valid non-zero count (documented behavior is that the last fragment of a fragmented transfer sets the count to 1), a zero value reaches a division operation and raises SIGFPE. This is the classic CWE-369 (Divide By Zero) root-cause class: an untrusted length/count field from a network-parsed protocol header is used in arithmetic without a sanity check. The fix adds an explicit zero check, logs 'Dropping LC3plus payload: Invalid RTP frame count', rewinds the payload buffer (ffb_rewind) and continues processing rather than decoding, confirming both the trigger condition and that the flaw is confined to non-fragmented media headers with a zero frame count.
Know when Bluez Alsa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Bluetooth-adjacent so AV:A; attacker must establish an A2DP source session so PR:L; impact is a restartable daemon crash so A:L with no C/I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB