CVE-2026-93015 in BTstack
Summary
by MITRE • 09/17/2026
BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in BlueKitchen BTstack versions through 1.8.2 represents a critical memory safety flaw within the Advanced Audio Distribution Profile implementation, specifically during the A2DP stream endpoint discovery phase. This issue stems from an insufficient validation of input data received from remote Bluetooth devices. When establishing or managing audio streams, the stack processes AVDTP DISCOVER responses sent by peer devices to enumerate available endpoints. The core technical failure lies in the absence of a bounds check when parsing the number of reported endpoints against the size of the internal fixed-size array allocated for storing this information. This lack of validation allows an attacker who has successfully bonded with the target device to exploit the discrepancy between the declared endpoint count and the actual capacity of the buffer, leading directly to memory corruption.
From a technical perspective, this flaw is classified as CWE-787: Out-of-bounds Write. The vulnerability occurs because the application blindly trusts the peer-reported value for the number of endpoints without verifying that it does not exceed the pre-allocated static table size. When an oversized DISCOVER response is processed, the write operation extends beyond the boundaries of the intended buffer into adjacent memory regions. Since these buffers are often allocated in static or global data segments, the overflow corrupts neighboring variables and control structures rather than heap metadata. This corruption can manifest as immediate process crashes due to segmentation faults or more subtle logic errors where critical state flags are overwritten, potentially altering program flow or disabling security checks.
The operational impact of this vulnerability is severe for any system relying on BTstack for audio connectivity. An authenticated attacker with a bonded relationship to the target device can trigger a denial-of-service condition by causing the Bluetooth stack process to crash, effectively severing all ongoing connections and requiring a restart of the service or device. Beyond simple availability disruption, the memory corruption opens pathways for more sophisticated attacks if the overwritten adjacent objects include function pointers or return addresses, although the static nature of the buffer makes arbitrary code execution less straightforward than in heap-based vulnerabilities. Nevertheless, the integrity of the application is compromised, and the stability of the Bluetooth subsystem is fundamentally undermined by this unchecked input handling.
This vulnerability aligns with ATT&CK technique T1498: Network Denial of Service, as it allows an adversary to disrupt service availability through resource exhaustion or process termination via memory corruption. It also reflects CWE-20: Improper Input Validation, highlighting the failure to sanitize external data before processing. To mitigate this risk, developers must implement strict bounds checking when parsing AVDTP DISCOVER responses. The number of endpoints reported by the peer should be validated against the maximum capacity of the local endpoint table before any write operations are performed. If the count exceeds the limit, the connection should be rejected or truncated safely without writing to memory outside the allocated buffer. Updating to a patched version of BTstack that includes these validation checks is essential for maintaining secure and stable Bluetooth audio functionality in embedded systems and mobile applications.