CVE-2026-80185Medium· 5.7▾ SunlitBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a loc…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
bluez (all versions)bluezbluez (all versions)bluez (all versions)bluez (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Until a fix is available, restrict untrusted local access to the org.bluez.ProfileManager1.RegisterProfile D-Bus method, or more broadly to the org.bluez name on the system bus, for example via a D-Bus system bus policy or polkit rule, so that untrusted callers cannot submit arbitrary ServiceRecord XML. Disabling the Bluetooth service on systems where it is not required also reduces exposure.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80186High· 7.6Bluez: stack overflow in name2utf8 causes dos and potential code execution
CVE-2026-19774High· 7.1BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2026-18504Medium· 5.4fastify: fastify: Schema validation bypass via root primitive coercion mismatch (CVE-2026-18504)
CVE-2026-105958High· 7.5Spice-server: spice: heap oob read/write via unchecked migration data offsets
CVE-2026-111555Medium· 6.0Luksmeta: missing slot-range validation permits out-of-gap device i/o
CVE-2026-105959High· 7.5Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation