BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.
The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20852.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1903/ | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1903/ | Vendor Advisory |
Configurations
History
09 Jul 2025, 17:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.zerodayinitiative.com/advisories/ZDI-23-1903/ - Vendor Advisory | |
| CPE | cpe:2.3:a:bluez:bluez:5.66:*:*:*:*:*:*:* | |
| First Time |
Bluez
Bluez bluez |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.7 |
03 May 2024, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-03 03:16
Updated : 2025-07-09 17:00
NVD link : CVE-2023-51580
Mitre link : CVE-2023-51580
JSON object : View
Products Affected
bluez
- bluez
CWE
No CWE.