Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
Summary
| CVE | CVE-2026-75032 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-18 15:17:12 UTC |
| Updated | 2026-08-20 13:08:53 UTC |
| Description | A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device. |
Risk And Classification
Primary CVSS: v3.1 6.3 MEDIUM from [email protected]
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS: 0.001960000 probability, percentile 0.096890000 (date 2026-08-20)
Problem Types: CWE-125 | CWE-125 Out-of-bounds Read
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 6.3 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H |
| 3.1 | CNA | CVSS | 6.3 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
HighCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 10 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/security/cve/CVE-2026-75032 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-08-17T16:03:05.186Z | Reported to Red Hat. |
| CNA | 2026-08-17T00:00:00.000Z | Made public. |
Workarounds
CNA: Disable the AVRCP Bluetooth profile if it is not needed, or restrict Bluetooth pairing to trusted devices only. On systems where Bluetooth is not required, disable the Bluetooth subsystem entirely.
There are currently no legacy QID mappings associated with this CVE.