BlueZ: A2DP Buffer Overflow Enables Root RCE After Pairing

ZDI-26-589 discloses a stack-based buffer overflow in the BlueZ Bluetooth stack's A2DP module, allowing remote code execution as root after pairing a malicious device. A patch doubling the codec capability buffer was merged upstream in June 2026.

On August 24, 2026, advisory ZDI-26-589 disclosed a vulnerability in the A2DP module of BlueZ, the standard Bluetooth stack for Linux distributions. A stack-based buffer overflow in stream endpoint handling enables remote code execution with root privileges by an attacker who has completed pairing with the target system. Coordination between Trend Micro's Zero Day Initiative and the project maintainer produced a patch available since June 2026.

Key Takeaways

ZDI-26-589 / CVE-2026-19774: stack-based buffer overflow in A2DP codec capability parsing in BlueZ
Attack condition: pairing a malicious network-adjacent Bluetooth device with the target system
Impact: arbitrary code execution in the context of root
Upstream GitHub patch #2251, merged June 22, 2026, doubles the buffer size for codec capability storage
CVSS not available in advisory; affected versions not specified

The Flaw: Insufficient Buffer for Codec Capability String Representation

The root cause lies in a mismatch between storage format and allocated space in the A2DP codec capability handling code. The stack-based buffer intended to hold capability data is filled by a routine that does not validate the length of user-supplied data before copying it into memory.

"Codec capability is one byte long (max 255) the storage format is 02hhx which means each byte ends up as 2 characters so the buffer needs to be doubled in order to handle capabilities of that size." — Luiz Augusto von Dentz, BlueZ patch commit #2251

The patch, reported by p0her of TeamH4C in collaboration with Trend Micro's Zero Day Initiative and approved on June 22, 2026, modifies five lines in a2dp.c. The buffer size is doubled to accommodate the string representation of capabilities.

The 02hhx format converts each byte into two hexadecimal characters. With a maximum capability of 255 bytes, the string representation requires 510 characters plus the terminator. The original buffer was not sized for this expansion.

The Attack Chain: From Pairing to Root Execution

The ZDI advisory describes an attack condition requiring network proximity and completion of the pairing procedure between the malicious device and the target system. This requirement places the vulnerability in an intermediate category: it is not exploitable without interaction, yet pairing does not automatically guarantee validation of subsequently exchanged data.

Compromise occurs during A2DP stream endpoint negotiation, when the remote device presents its codec capabilities. The ZDI advisory confirms the impact is code execution "in the context of root," indicating the Bluetooth daemon operates with elevated privileges on affected installations.

The official advisory states: "This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ." It further notes: "The specific flaw exists within the handling of the stream endpoints. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer."

The Coordinated Timeline

The vulnerability was reported to the vendor on April 8, 2026. The patch was merged on June 22, 2026. The coordinated public release of the ZDI advisory is dated August 24, 2026.

The CVE-2026-19774 record currently shows a "reserved" status at CVE.org: the number is assigned and confirmed, but technical details have not yet been populated by the responsible CNA. The ZDI advisory does not specify a CVSS score or vector.

Specific affected BlueZ versions are not detailed in the published ZDI material. GitHub patch #2251 nonetheless represents the canonical upstream fix, identifiable by the explicit buffer modification in a2dp.c.

Recommended Actions

Verify the presence of GitHub patch #2251 in your distribution repository: the commit explicitly modifies the buffer in a2dp.c and represents the canonical upstream fix
Restrict Bluetooth pairing to authorized devices, as pairing a malicious device is the prerequisite for exploitation
Monitor the CVE-2026-19774 record for the eventual publication of CVSS score and affected versions
Ensure your Linux distribution's BlueZ packages include the June 2026 commit

Analysis: The Boundary Between Authentication and Validation

The incident highlights a recurring separation in communication protocols: Bluetooth pairing authenticates device identity, not the correctness of data it transmits. The A2DP stream endpoint negotiation phase, which follows pairing, is presumed protected by the trust established earlier. This assumption allowed a fixed-size buffer to receive attacker-controlled data lengths.

The 02hhx serialization format, chosen to represent a binary value in human-readable form, generated a classic sizing error: the conversion expands the data without the destination buffer being adequately sized. The discrepancy between 255 bytes of maximum capability and the 510-character representation plus terminator is the technical detail that made the bug exploitable.

The report by p0her of TeamH4C, coordinated through Trend Micro's Zero Day Initiative, produced a structured disclosure with vendor response times of approximately two and a half months between report and patch, and a further two months between patch and advisory publication.

Information is based on the primary ZDI advisory with corroboration from the GitHub patch. The CVE-2026-19774 record is in reserved status; CVSS and affected versions are not available in the sources consulted.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references