Bug 2517877

Summary:	CVE-2026-75032 bluez: BlueZ: Out-of-bounds read in AVRCP parse_media_element and parse_media_folder [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Oleg Sushchenko <osushche>
Component:	bluez	Assignee:	Peter Robinson <pbrobinson>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	bnocera, dwmw2, lihis, michel, ngompa13, pbrobinson
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["02690aef-9398-4eed-abb2-48c5a67ef774"]}
Fixed In Version:	bluez-5.87-4.fc44 bluez-5.87-4.fc43	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-08-22 01:24:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Oleg Sushchenko 2026-08-18 13:04:12 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An out-of-bounds read flaw was found in BlueZ in the AVRCP profile 
implementation. The vulnerability exists in the parse_media_element() 
and parse_media_folder() functions in profiles/audio/avrcp.c, where 
insufficient validation of packet length fields in GetFolderItems 
responses allows a malicious Bluetooth device within range to cause 
an out-of-bounds memory read. This can result in a crash of the 
bluetoothd daemon (denial of service) and potentially expose 
sensitive heap memory contents.

Comment 1 Fedora Update System 2026-08-19 14:24:12 UTC

FEDORA-2026-1bbec06c4d (bluez-5.87-4.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-1bbec06c4d

Comment 2 Fedora Update System 2026-08-19 14:24:44 UTC

FEDORA-2026-a1cdcc1604 (bluez-5.87-4.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a1cdcc1604

Comment 3 Fedora Update System 2026-08-20 16:39:50 UTC

FEDORA-2026-1bbec06c4d has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-1bbec06c4d`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-1bbec06c4d

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2026-08-20 16:40:18 UTC

FEDORA-2026-a1cdcc1604 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a1cdcc1604`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a1cdcc1604

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-08-22 01:24:19 UTC

FEDORA-2026-1bbec06c4d (bluez-5.87-4.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Fedora Update System 2026-08-27 01:11:11 UTC

FEDORA-2026-a1cdcc1604 (bluez-5.87-4.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.