Critical Buffer Overflow Vulnerability in BlueZ Package Leading to Remote Code Execution
Summary
DEBIAN-CVE-2026-19774: BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. Affects bluez versions 5.66-1 – 5.87-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
BlueZ is the official Linux Bluetooth protocol stack, providing support for the core Bluetooth layers and protocols. It enables communication between Bluetooth devices and Linux-based systems, offering functionalities such as audio streaming, file transfer, and device management. The package is widely used in various Linux distributions, making it crucial for maintaining secure Bluetooth communications. However, it is susceptible to a severe vulnerability that can be exploited by attackers.
Vulnerability Detail
The vulnerability identified as CVE-2026-19774 is a stack-based buffer overflow in the A2DP (Advanced Audio Distribution Profile) stack of BlueZ. This flaw arises from inadequate validation of user-supplied data length before it is copied to a fixed-length stack-based buffer. An attacker with the ability to pair a malicious Bluetooth device can exploit this vulnerability to execute arbitrary code with root privileges on the affected system. The potential ramifications include unauthorized access, data manipulation, and complete system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable Bluetooth functionality until the package is updated. This can be achieved by running the command:
sudo systemctl stop bluetooth' to stop the Bluetooth service.
Conclusion
The CVE-2026-19774 vulnerability in the BlueZ package poses a significant risk to systems using Bluetooth functionality. It is essential to update to the patched version to mitigate potential threats. Users can also utilize Vulert for real-time monitoring of vulnerabilities in their software.
See every vulnerability recorded for bluez →
FAQ
CVE-2026-19774 is a critical buffer overflow vulnerability in the BlueZ Bluetooth stack that allows remote code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and complete control over the affected system.
Yes, a patch is available in version 5.87-1 of the BlueZ package. Users should update to this version or later.
As a temporary measure, you can disable Bluetooth functionality on your system until the update is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for bluez.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
