BlueZ A2DP Stack-Based Buffer Overflow Enables Root RCE via Malicious Bluetooth Pairing
AI analysis
BlueZ, the standard Bluetooth protocol stack for Linux, contains a stack-based buffer overflow (CWE-121) in its handling of A2DP stream endpoints, disclosed by ZDI as ZDI-26-589. The flaw stems from failure to validate the length of attacker-supplied data before copying it into a fixed-length stack buffer. A network-adjacent attacker must first pair a malicious Bluetooth device with the target system — which requires physical/proximity access and typically user interaction to accept pairing — after which successful exploitation yields arbitrary code execution in the context of root. Any Linux system running a vulnerable BlueZ build with Bluetooth enabled and A2DP audio profiles exposed is potentially at risk. No public proof-of-concept exists and the vulnerability is not listed in CISA's KEV catalog, so exploitation status is currently none known.
What to do: Update BlueZ to the latest package released through your Linux distribution's package manager as soon as a patched build is available. In the interim, disable Bluetooth or set adapters to non-discoverable/non-pairable mode on systems that do not need A2DP audio, and reject or review unexpected inbound pairing requests. Verify that audio services (PipeWire/PulseAudio Bluetooth modules) are only enabled on hosts where Bluetooth audio is actually required.
Affected
| BlueZ project BlueZ (Bluetooth protocol stack, A2DP stream endpoint handling) | — |
Estimated exposure
massPotentially hundreds of millions of Bluetooth-enabled Linux systems (order of magnitude), though practically constrained by pairing requirements — BlueZ is the default Bluetooth stack shipped with virtually every Linux distribution and embedded Linux device, so the theoretical install base is enormous, but exploitation requires Bluetooth proximity plus a successful pairing, sharply…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29429.