CVE-2026-118605 in iLX-F511
Summary
by MITRE • 10/28/2026
Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.
The specific flaw exists within the prh_sdp_service_search_decode function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29069.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Alpine iLX-F511 head unit contains a critical remote code execution vulnerability within its Bluetooth protocol implementation, specifically identified as CVE-2023-4879 and tracked under Zero Day Initiative identifier ZDI-CAN-29069. This flaw resides in the prh_sdp_service_search_decode function, which is responsible for parsing Service Discovery Protocol (SDP) data during the Bluetooth pairing process. The vulnerability stems from a fundamental failure to validate the length of user-supplied input before copying it into a fixed-size stack-based buffer. When an attacker pairs a malicious Bluetooth device with the target system, they can supply crafted SDP records containing oversized or malformed data fields. Because the application does not perform adequate bounds checking on these inputs, the excess data overflows the allocated memory space on the call stack, corrupting adjacent memory structures such as return addresses and frame pointers.
This type of flaw is classically categorized under CWE-121: Stack-based Buffer Overflow in industry standards like MITRE. The operational impact of this vulnerability is severe because it allows for arbitrary code execution with root privileges. Since Bluetooth pairing typically requires physical proximity, the attack vector is classified as network-adjacent rather than fully remote over the internet. However, once an attacker successfully pairs their device and triggers the buffer overflow through a specially crafted SDP packet, they can gain complete control over the embedded operating system running on the head unit. This level of access enables the execution of arbitrary commands, potentially allowing for data exfiltration, installation of persistent malware, or use of the vehicle's infotainment system as a pivot point to attack other connected systems within the automotive network architecture.
The exploitation path relies heavily on social engineering or physical proximity attacks where an adversary must first establish a trusted Bluetooth connection with the victim device. This prerequisite limits the blast radius compared to purely remote exploits but does not diminish the severity given that vehicles are often left unattended in public spaces. The lack of input validation represents a significant deviation from secure coding practices, particularly for embedded systems handling wireless protocols where data integrity is paramount. Mitigation strategies primarily involve applying vendor-provided firmware updates that patch the prh_sdp_service_search_decode function to include strict length checks and buffer size validations before memory copy operations occur. Until such patches are applied, users should avoid pairing with untrusted Bluetooth devices and disable unnecessary Bluetooth services if not actively in use. Security researchers emphasize that this vulnerability highlights the importance of rigorous input sanitization in automotive infotainment systems which increasingly serve as gateways to broader vehicle networks.