CVE-2026-28526: BTstack Buffer Overflow Vulnerability

CVE-2026-28526 Overview

BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability (CWE-125) in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers. This vulnerability allows attackers to read beyond buffer boundaries when processing specially crafted Bluetooth Classic responses.

A nearby attacker with a paired Bluetooth Classic connection can send a specially crafted VENDOR_DEPENDENT response with an attacker-controlled count value to trigger an out-of-bounds read from the L2CAP receive buffer, potentially causing a crash on resource-constrained devices.

Critical Impact

Resource-constrained IoT and embedded devices using BTstack for Bluetooth functionality may experience denial of service conditions when exploited by an attacker within Bluetooth range.

Affected Products

• BlueKitchen BTstack versions prior to 1.8.1
• IoT devices and embedded systems utilizing BTstack for Bluetooth Classic connectivity
• AVRCP Controller implementations in BTstack-based audio systems

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-28526 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-28526

Vulnerability Analysis

This out-of-bounds read vulnerability exists in the AVRCP (Audio/Video Remote Control Profile) Controller component of BTstack. The vulnerable code paths are in the handlers for LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES commands, which fail to properly validate the count value received in VENDOR_DEPENDENT responses.

When a malicious Bluetooth device sends a response with an artificially inflated count value, the handler attempts to read more data from the L2CAP receive buffer than is actually present, resulting in an out-of-bounds memory access. On resource-constrained embedded systems, this can lead to application crashes or unexpected behavior.

The attack requires an adjacent network position (Bluetooth range) and a paired connection, limiting the attack surface to scenarios where an attacker is physically nearby and can establish a Bluetooth Classic pairing with the target device.

Root Cause

The root cause is improper input validation in the AVRCP Controller message handlers. The count field received in VENDOR_DEPENDENT responses is used directly to determine how many bytes to read from the L2CAP buffer without verifying that the buffer actually contains sufficient data. This missing bounds check allows the read operation to exceed the buffer boundaries.

Attack Vector

The attack requires adjacent network access via Bluetooth Classic connectivity. An attacker within Bluetooth range must first establish a paired connection with the vulnerable device. Once paired, the attacker sends malicious AVRCP VENDOR_DEPENDENT responses containing a count value that exceeds the actual data present in the response payload. When the BTstack AVRCP Controller processes this response, it reads beyond the allocated L2CAP receive buffer.

The exploitation mechanism involves:

1. Establishing a Bluetooth Classic pairing with the target device
2. Initiating an AVRCP session as a remote target device
3. Responding to LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES or LIST_PLAYER_APPLICATION_SETTING_VALUES requests with malformed count values
4. Triggering the out-of-bounds read when the vulnerable handler processes the response

Detection Methods for CVE-2026-28526

Indicators of Compromise

• Unexpected crashes or restarts of Bluetooth-enabled embedded devices
• Anomalous Bluetooth Classic pairing attempts from unknown devices
• AVRCP protocol errors or malformed response handling in device logs
• Memory access violations in BTstack AVRCP Controller components

Detection Strategies

• Monitor Bluetooth connection logs for unusual pairing activity from unrecognized devices
• Implement firmware integrity monitoring on embedded devices to detect crash patterns
• Deploy network sensors capable of Bluetooth traffic analysis to identify malformed AVRCP responses
• Enable verbose logging in BTstack implementations to capture protocol-level anomalies

Monitoring Recommendations

• Review device crash logs for patterns consistent with memory access violations
• Monitor for repeated Bluetooth reconnection attempts that may indicate exploitation attempts
• Implement alerting on AVRCP session anomalies in Bluetooth-enabled device fleets
• Track firmware version compliance across deployed BTstack implementations

How to Mitigate CVE-2026-28526

Immediate Actions Required

• Update BlueKitchen BTstack to version 1.8.1 or later immediately
• Audit all IoT and embedded devices in your environment for BTstack usage
• Consider temporarily disabling Bluetooth Classic functionality on critical devices until patched
• Review Bluetooth pairing policies to restrict connections to known, trusted devices

Patch Information

BlueKitchen has released version 1.8.1 of BTstack which addresses this vulnerability. The patched version includes proper bounds checking in the AVRCP Controller handlers for LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES responses.

For detailed patch information, refer to the GitHub BTstack Release v1.8.1. Additional technical details are available in the VulnCheck Advisory for BTstack.

Workarounds

• Restrict Bluetooth pairing to known, trusted devices only using allowlist-based pairing policies
• Disable AVRCP Controller functionality if not required for device operation
• Implement physical security controls to limit attacker proximity to vulnerable devices
• Consider network segmentation to isolate Bluetooth-enabled devices from critical infrastructure

# Configuration example - Disable AVRCP Controller in BTstack (if supported by your implementation)
# Consult BTstack documentation for specific configuration options
# btstack_config.h modifications:
# #define ENABLE_AVRCP_CONTROLLER 0