CVE-2026-28528 in BlueKitchen BTstack
Résumé (Anglaise)
BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Browsing Target GET_FOLDER_ITEMS handler that fails to validate packet boundaries and attribute count data. An attacker with a paired Bluetooth Classic connection can exploit insufficient bounds checking on the attr_id parameter to cause crashes and corrupt attribute bitmap state.
Responsable
VulnCheck
Réserver
27/02/2026
Divulgation
30/03/2026
Entrées
| ID | Vulnérabilité | CWE | Base | Temp | 0day | Aujourd'hui | Exp | KEV | EPSS | CTI | Con | CVE |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 354193 | BlueKitchen BTstack AVRCP Browsing Target divulgation d'information | 125 | 5.1 | 4.9 | $0-$5k | $0-$5k | Non défini | 0.00000 | 3.32+ | Correctif officiel | CVE-2026-28528 |