---
id: CVE-2026-93015
title: >-
  BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint
  count against table bounds in A2DP stream endpoint discovery
summary: >-
  BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint
  count against table bounds in A2DP stream endpoint discovery. A bonded peer
  can send an AVDTP DISCOVER response with more endpoints than the fixed table
  holds…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-787
  - CWE-1284
vendor: BlueKitchen GmbH
product: BTstack
affected:
  - BTstack <= 1.8.2
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T20:19:00.410'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93015'
references:
  - url: 'https://github.com/bluekitchen/btstack'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/a2dp.c#L568'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/avdtp.c#L1703
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/bluekitchen/btstack/commit/fc208fcce056d4e0a5bb916abc90e83a383e1cdf
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/bluekitchen-btstack-through-1.8.2-a2dp-sep-discovery-out-of-bounds-write
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T19:17:13.890422Z'
ingestedAt: '2026-09-17T16:21:47.718Z'
epss: 0.00243
epssPercentile: 0.15833
---

## Overview

BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.