Vulnerability · Published Aug 18, 2026 · Assigned by redhat
CVE-2026-75032Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder
Medium 6.3
In plain English
A medium-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | bluez | no fix listed | DEBIAN-CVE-2026-75032 |
| Debian:13 | bluez | no fix listed | DEBIAN-CVE-2026-75032 |
| Debian:14 | bluez | 5.87-2 | DEBIAN-CVE-2026-75032 |
| Ubuntu:22.04:LTS | bluez | 5.64-0ubuntu1.5 | UBUNTU-CVE-2026-75032 |
| Ubuntu:22.04:LTS | bluez | 5.64-0ubuntu1.5 | USN-8908-1 |
| Ubuntu:24.04:LTS | bluez | 5.72-0ubuntu5.7 | USN-8908-1 |
| Ubuntu:24.04:LTS | bluez | 5.72-0ubuntu5.7 | UBUNTU-CVE-2026-75032 |
| Ubuntu:26.04:LTS | bluez | 5.85-4ubuntu0.3 | USN-8908-1 |
| Ubuntu:26.04:LTS | bluez | 5.85-4ubuntu0.3 | UBUNTU-CVE-2026-75032 |
| Ubuntu:26.10 | bluez | no fix listed | UBUNTU-CVE-2026-75032 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-75032 vdb-entry, x_refsource_REDHAT
- RHBZ#2517490 issue-tracking, x_refsource_REDHAT