BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device.
The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20854.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1905/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1905/ | Third Party Advisory |
Configurations
History
08 Jul 2025, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.7 |
| First Time |
Bluez
Bluez bluez |
|
| CPE | cpe:2.3:a:bluez:bluez:5.66:*:*:*:*:*:*:* | |
| References | () https://www.zerodayinitiative.com/advisories/ZDI-23-1905/ - Third Party Advisory |
03 May 2024, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-03 03:16
Updated : 2025-07-08 16:27
NVD link : CVE-2023-51592
Mitre link : CVE-2023-51592
JSON object : View
Products Affected
bluez
- bluez
CWE
No CWE.