{"id":"CVE-2026-80185","title":"Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root","summary":"BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a loc…","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-843"],"vendor":"Red Hat","product":"bluez","affected":["bluez (all versions)","bluez","bluez (all versions)","bluez (all versions)","bluez (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-26T14:36:37.542760Z"},"published":"2026-08-25","updated":"2026-10-16","sourceUpdated":"2026-10-16T11:54:41.199Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80185","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-80185"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524139","label":"RHBZ#2524139"}],"tags":["cve.org"],"epss":0.00292,"epssPercentile":0.20308,"ingestedAt":"2026-10-16T12:05:46.476Z","slug":"CVE-2026-80185","body":"## Overview\n\nBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.\n\n## Affected\n\n- `bluez (all versions)`\n- `bluez`\n- `bluez (all versions)`\n- `bluez (all versions)`\n- `bluez (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nUntil a fix is available, restrict untrusted local access to the org.bluez.ProfileManager1.RegisterProfile D-Bus method, or more broadly to the org.bluez name on the system bus, for example via a D-Bus system bus policy or polkit rule, so that untrusted callers cannot submit arbitrary ServiceRecord XML. Disabling the Bluetooth service on systems where it is not required also reduces exposure.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}