---
id: CVE-2026-75032
title: >-
  Bluez: bluez: out-of-bounds read in avrcp parse_media_element and
  parse_media_folder
summary: >-
  A flaw was found in BlueZ. Insufficient validation of packet length fields in
  GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP)
  implementation allows a malicious Bluetooth device within range to cause an
  out-…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: bluez
affected:
  - bluez (all versions)
  - bluez
  - bluez (all versions)
  - bluez (all versions)
  - bluez (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-19T14:29:03.307228Z'
published: '2026-08-18'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T00:43:27.202Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-75032'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-75032'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517490'
    label: RHBZ#2517490
tags:
  - cve.org
epss: 0.00241
epssPercentile: 0.15354
ingestedAt: '2026-11-06T01:43:15.135Z'
---

## Overview

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

## Affected

- `bluez (all versions)`
- `bluez`
- `bluez (all versions)`
- `bluez (all versions)`
- `bluez (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Disable the AVRCP Bluetooth profile if it is not needed, or restrict Bluetooth pairing to trusted devices only. On systems where Bluetooth is not required, disable the Bluetooth subsystem entirely.