CVE-2026-79377: BES2300 Bluetooth SoC DoS Vulnerability

CVE-2026-79377 Overview

CVE-2026-79377 is a heap overflow vulnerability in the a2dp_decoder_sbc.cpp component of the Bestechnic BES2300 Bluetooth Audio System-on-Chip (SoC) firmware. The flaw affects firmware version 3.x and earlier. Attackers can trigger the condition by sending a crafted Logical Link Control and Adaptation Protocol (L2CAP) packet to the target device. Successful exploitation causes a Denial of Service (DoS) on the affected Bluetooth audio device. The vulnerability is categorized as a heap-based buffer overflow [CWE-122] and is exploitable over the network without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers within Bluetooth range can crash BES2300-based audio devices by transmitting a malformed L2CAP packet to the Advanced Audio Distribution Profile (A2DP) SBC decoder.

Affected Products

Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x
Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware versions earlier than v3.x
Products embedding the vulnerable a2dp_decoder_sbc.cpp component from the BES audio player stack

Discovery Timeline

2026-09-08 - CVE-2026-79377 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79377

Vulnerability Analysis

The vulnerability resides in the SBC (Sub-Band Coding) decoder implementation used by the A2DP profile on the BES2300 SoC. A2DP is the Bluetooth profile responsible for streaming stereo audio between devices, and SBC is its mandatory codec. The decoder processes audio frames delivered inside L2CAP packets. When the decoder handles a specifically crafted frame, it writes beyond the bounds of a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap metadata and structures, causing the firmware to fault and terminate audio processing. Because the decoder runs on a memory-constrained embedded SoC without robust heap hardening, the corruption results in a device crash rather than a controlled failure.

Root Cause

The root cause is missing or insufficient validation of size fields extracted from the incoming SBC frame before they are used to index or copy into a fixed heap buffer. The decoder trusts attacker-controlled length values from the L2CAP payload, allowing writes to exceed the allocated region. Refer to the GitHub A2DP Decoder Implementation for the affected source.

Attack Vector

An attacker within Bluetooth radio range establishes or hijacks an A2DP session with the target device. The attacker then transmits a crafted L2CAP packet containing a malformed SBC frame to the decoder. No authentication or user interaction is required beyond the Bluetooth pairing state that A2DP typically permits. The result is loss of audio service and device reset. Additional technical context is available in the Best Technic advisory document.

Detection Methods for CVE-2026-79377

Indicators of Compromise

Repeated unexpected reboots or resets of BES2300-based Bluetooth audio devices during active A2DP streaming
Audio dropouts or session termination correlated with the presence of unknown Bluetooth devices in radio range
Firmware crash logs referencing the a2dp_decoder_sbc module or heap corruption faults

Detection Strategies

Inspect Bluetooth traffic captures for malformed SBC frames with inconsistent length fields inside L2CAP payloads
Correlate device crash telemetry with proximity of unpaired or unknown Bluetooth Media Access Control (MAC) addresses
Monitor device management platforms for abnormal reboot rates across fleets of BES2300-based accessories

Monitoring Recommendations

Enable firmware crash reporting on managed audio devices and forward events to a centralized log store for analysis
Track Bluetooth pairing and connection attempts on enterprise-managed endpoints to identify anomalous A2DP sources
Alert on repeated A2DP session resets from the same peer device within short time windows

How to Mitigate CVE-2026-79377

Immediate Actions Required

Inventory all devices using the Bestechnic BES2300 SoC and identify firmware versions in the 3.x or earlier range
Disable Bluetooth or A2DP functionality on affected devices in high-risk or public environments until firmware updates are applied
Restrict device discoverability and require explicit pairing to reduce exposure to unauthenticated attackers

Patch Information

Refer to the vendor documentation at the Best Technic advisory for firmware update availability. Original equipment manufacturers integrating the BES2300 SoC should coordinate with Bestechnic for a fixed decoder release and distribute updated firmware to end users.

Workarounds

Operate affected devices in non-discoverable mode and unpair unknown or unused Bluetooth peers
Physically isolate affected devices from untrusted radio environments where possible
Reduce Bluetooth transmit power on paired hosts to limit the effective attack range against embedded accessories

bash

# Configuration example: disable Bluetooth service on a Linux host used with the affected accessory
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service

# Verify status
systemctl status bluetooth.service