{"id":"CVE-2026-75032","title":"Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder","summary":"A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Red Hat","product":"bluez","affected":["bluez (all versions)","bluez","bluez (all versions)","bluez (all versions)","bluez (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-19T14:29:03.307228Z"},"published":"2026-08-18","updated":"2026-11-06","sourceUpdated":"2026-11-06T00:43:27.202Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-75032","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-75032"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517490","label":"RHBZ#2517490"}],"tags":["cve.org"],"epss":0.00241,"epssPercentile":0.15354,"ingestedAt":"2026-11-06T01:43:15.135Z","slug":"CVE-2026-75032","body":"## Overview\n\nA flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.\n\n## Affected\n\n- `bluez (all versions)`\n- `bluez`\n- `bluez (all versions)`\n- `bluez (all versions)`\n- `bluez (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nDisable the AVRCP Bluetooth profile if it is not needed, or restrict Bluetooth pairing to trusted devices only. On systems where Bluetooth is not required, disable the Bluetooth subsystem entirely.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}