ZDI-26-589: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ, the standard Bluetooth protocol stack for Linux, contains a stack-based buffer overflow (CWE-121) in its handling of A2DP stream endpoints, disclosed by ZDI as ZDI-26-589. The flaw stems from failure to validate the length of attacker-supplied data before copying it into a fixed-length stack buffer. A network-adjacent attacker must first pair a malicious Bluetooth device with the target system — which requires physical/proximity access and typically user interaction to accept pairing — after which successful exploitation yields arbitrary code execution in the context of root. Any Linux system running a vulnerable BlueZ build with Bluetooth enabled and A2DP audio profiles exposed is potentially at risk. No public proof-of-concept exists and the vulnerability is not listed in CISA's KEV catalog, so exploitation status is currently none known.

Do: Update BlueZ to the latest package released through your Linux distribution's package manager as soon as a patched build is available. In the interim, disable Bluetooth or set adapters to non-discoverable/non-pairable mode on systems that do not need A2DP audio, and reject or review unexpected inbound pairing requests. Verify that audio services (PipeWire/PulseAudio Bluetooth modules) are only enabled on hosts where Bluetooth audio is actually required.