ZDI 2026-10-28

ZDI-26-828: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2026-118610

Machine-generated analysis · WAYSCloud LLM

Unauthenticated remote code execution via a stack-based buffer overflow in the Android Auto service stack of Alpine iLX-F511 devices.

Context

The advisory concerns Alpine iLX-F511 devices. It describes a stack-based buffer overflow in the Android Auto service stack that enables unauthenticated remote code execution for network-adjacent attackers. The advisory assigns a CVSS base score of 8.8.

Operator considerations

Check: Inventory Alpine iLX-F511 units in the environment.
Isolate: Place affected iLX-F511 devices on a segregated network segment or restrict network access.
Log: Record inbound connections to the Android Auto service on the device.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-118610.

Read the full advisory on ZDI →

Related advisories