{"id":"CVE-2026-93015","title":"BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery","summary":"BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cwe":["CWE-787","CWE-1284"],"vendor":"BlueKitchen GmbH","product":"BTstack","affected":["BTstack <= 1.8.2"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T20:19:00.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93015","references":[{"url":"https://github.com/bluekitchen/btstack","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/a2dp.c#L568","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/avdtp.c#L1703","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bluekitchen/btstack/commit/fc208fcce056d4e0a5bb916abc90e83a383e1cdf","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bluekitchen-btstack-through-1.8.2-a2dp-sep-discovery-out-of-bounds-write","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T19:17:13.890422Z"},"ingestedAt":"2026-09-17T16:21:47.718Z","epss":0.00243,"epssPercentile":0.15808,"slug":"CVE-2026-93015","body":"## Overview\n\nBlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}