ZDI 2026-08-24

ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2026-19774

Machine-generated analysis · WAYSCloud LLM

Exploitation requires pairing a malicious Bluetooth device with the target system.

Context

The advisory concerns the BlueZ A2DP stack. It contains a stack-based buffer overflow that can lead to remote code execution. An attacker must first pair a malicious Bluetooth device with the victim. The CVSS score is 7.1 (CVE-2026-19774).

Operator considerations

Check: verify the BlueZ version and whether the A2DP profile is enabled.
Isolate: disable or restrict Bluetooth pairing on systems where it is not needed.
Log: record Bluetooth pairing attempts and alert on unknown devices.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2026-19774.

Read the full advisory on ZDI →