Alpine iLX-F511 Bluetooth OBEX overflow allows unauthenticated code execution
ZDI rates the Pwn2Own zero-day at CVSS 6.8; a physically present attacker needs no authentication.
48
Vulnerability1 · 1 read
CVE-2026-118611
Heap overflow RCE in Alpine iLX-F511 via Bluetooth OBEX
- CVSS 3.0
- 6.8 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow in Alpine iLX-F511 devices mishandles Bluetooth OBEX packet lengths. A physically present attacker can send crafted OBEX data without authentication or user interaction and run arbitrary code as root. Only installations of the iLX-F511 are described as affected; affected builds are not listed.
What to do: No fixed version is stated. Apply Alpine’s update for CVE-2026-118611 if one is released.
| Product | Affected |
|---|---|
| Alpine iLX-F511 | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Bluetooth OBEX packets. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29012.
- Weakness
- CWE-122
- Vector
- CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H