Bluez Alsa
Monthly
BlueALSA's LC3plus A2DP sink decoder uses an attacker-supplied RTP frame count as a divisor without validating it, so a single non-fragmented LC3plus media header carrying a frame count of zero causes a SIGFPE that terminates the bluealsad daemon. Only builds compiled with the optional LC3plus decoder support are affected, and only when bluealsad acts as an A2DP sink; the attacker must be within Bluetooth-adjacent range and able to establish an A2DP source connection that negotiates an LC3plus session (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Impact is limited to a restartable daemon crash - no code execution, data exposure, or integrity loss beyond the availability hit - and no public exploit code was identified at time of analysis.
BlueALSA's LC3plus A2DP sink decoder uses an attacker-supplied RTP frame count as a divisor without validating it, so a single non-fragmented LC3plus media header carrying a frame count of zero causes a SIGFPE that terminates the bluealsad daemon. Only builds compiled with the optional LC3plus decoder support are affected, and only when bluealsad acts as an A2DP sink; the attacker must be within Bluetooth-adjacent range and able to establish an A2DP source connection that negotiates an LC3plus session (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Impact is limited to a restartable daemon crash - no code execution, data exposure, or integrity loss beyond the availability hit - and no public exploit code was identified at time of analysis.