---
id: CVE-2026-16473
title: 'Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame'
summary: >-
  A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in
  the SBC frame decoder allows a crafted audio payload to trigger a one-byte
  heap out-of-bounds read. This could allow an adjacent attacker streaming
  Bluetooth a…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: sbc
affected:
  - sbc (all versions)
  - sbc (all versions)
  - sbc (all versions)
  - sbc (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-22T18:31:03.980493Z'
published: '2026-07-22'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:47:47.809Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16473'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-16473'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2503650'
    label: RHBZ#2503650
  - url: 'https://git.kernel.org/pub/scm/bluetooth/sbc.git'
  - url: >-
      https://lore.kernel.org/linux-bluetooth/1660735014.5089519.1785359719739@mail.yahoo.com/
tags:
  - cve.org
epss: 0.00298
epssPercentile: 0.22575
ingestedAt: '2026-11-05T22:38:31.406Z'
---

## Overview

A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.

## Affected

- `sbc (all versions)`
- `sbc (all versions)`
- `sbc (all versions)`
- `sbc (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

There is no practical mitigation short of disabling Bluetooth A2DP audio decoding entirely. The SBC codec is mandatory for A2DP and the decode path is invoked automatically on incoming Bluetooth audio streams.