CVE-2025-8475: Alpine iLX-507 AVRCP RCE Vulnerability

CVE-2025-8475 Overview

CVE-2025-8475 is a stack-based buffer overflow [CWE-121] in the Alpine iLX-507 in-vehicle infotainment head unit. The flaw resides in the device's implementation of the Audio/Video Remote Control Profile (AVRCP), a Bluetooth profile used to control media playback. Network-adjacent attackers can exploit the vulnerability to execute arbitrary code as root on affected devices. Exploitation requires the target user to pair or connect to a malicious Bluetooth device. The issue was reported through the Zero Day Initiative as ZDI-CAN-26321.

Critical Impact
Successful exploitation yields arbitrary code execution in the context of root on the iLX-507 head unit, giving an adjacent attacker full control over vehicle infotainment functionality.

Affected Products

Alps Alpine iLX-507 (hardware)
Alps Alpine iLX-507 firmware version 6.0.000
Bluetooth AVRCP stack shipped with the iLX-507

Discovery Timeline

2025-08-01 - CVE-2025-8475 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8475

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow in the AVRCP protocol handler running on the Alpine iLX-507. AVRCP is transported over Bluetooth L2CAP and typically negotiates metadata such as track titles, artist names, and player status between a Bluetooth source and a controller. When the head unit processes AVRCP messages from a paired peer, the implementation copies attacker-controlled data into a fixed-length stack buffer without first validating the source length. An adjacent attacker who can convince a user to pair with, or connect to, a malicious Bluetooth device supplies an oversized AVRCP field and overwrites adjacent stack memory, including the saved return address. Because the AVRCP service runs as root, code executed through the overflow inherits root privileges on the infotainment unit. Exploitation is constrained by Bluetooth range and by the required user interaction to accept the pairing or connection.

Root Cause

The root cause is missing input length validation prior to a stack copy operation in the AVRCP parser. The implementation trusts length or terminator values supplied by the remote Bluetooth peer instead of enforcing the destination buffer size, matching the CWE-121 pattern.

Attack Vector

The attack vector is adjacent-network Bluetooth. The attacker must be within Bluetooth radio range of the vehicle and must persuade the driver or passenger to initiate a connection to an attacker-controlled Bluetooth source. Once connected, the attacker sends a crafted AVRCP message that triggers the overflow and hijacks execution on the head unit.

No verified public proof-of-concept code is available. See the Zero Day Initiative Advisory ZDI-25-764 for additional technical detail.

Detection Methods for CVE-2025-8475

Indicators of Compromise

Unexpected Bluetooth pairing entries on the iLX-507 that do not correspond to owner-approved devices.
Head unit crashes, reboots, or unresponsive AVRCP media controls immediately after connecting to an unknown Bluetooth source.
Anomalous outbound network activity from the head unit following a Bluetooth session with an unfamiliar peer.

Detection Strategies

Inspect firmware version reporting to confirm whether devices are running the affected 6.0.000 build.
Where fleet telemetry is available, alert on AVRCP protocol errors and abnormal L2CAP disconnects that correlate with new pairings.
Treat any user report of infotainment instability after Bluetooth use as a potential exploitation attempt and preserve device logs for analysis.

Monitoring Recommendations

Review Bluetooth pairing history during routine service visits and remove unknown peers.
For commercial or fleet deployments, monitor head-unit diagnostic channels for repeated AVRCP parser faults.
Track vendor advisories from Alps Alpine and the Zero Day Initiative for firmware updates addressing CVE-2025-8475.

How to Mitigate CVE-2025-8475

Immediate Actions Required

Disable Bluetooth on the iLX-507 when not actively required for media or hands-free calling.
Do not accept Bluetooth pairing requests from unknown or untrusted devices, and never confirm pairing prompts that appear unsolicited.
Remove any previously paired devices that are no longer in use to reduce the attackable pairing surface.

Patch Information

At the time of publication, no vendor advisory URL or firmware fix is referenced in the NVD entry for CVE-2025-8475. Owners and installers should monitor Alps Alpine support channels and the Zero Day Initiative Advisory ZDI-25-764 for updated firmware for the iLX-507 running 6.0.000.

Workarounds

Keep Bluetooth disabled on the head unit until a vendor firmware update is available.
Use a wired connection such as USB or auxiliary input for media playback instead of AVRCP over Bluetooth.
Limit physical and radio proximity access to the vehicle in higher-risk environments, since exploitation requires Bluetooth range.

bash

# Operational guidance for iLX-507 owners (no configuration file exists on the head unit itself)
# 1. From the iLX-507 settings menu, open Bluetooth settings
# 2. Set Bluetooth to OFF, or
# 3. Delete all paired devices and re-pair only known, trusted phones
# 4. Refuse any pairing prompt initiated from an unknown source