A double stack-based buffer overflow was found in the BlueZ AVRCP controller implementation in profiles/audio/avrcp.c. When processing an AVRCP player settings response, avrcp_list_player_attributes_rsp() trusts an attacker-controlled attribute count from pdu->params[0] and writes past a 4-byte stack array (attrs[4]). The inflated count (up to 255) is then passed to avrcp_get_current_player_value(), which copies attacker-controlled data into a 12-byte stack buffer via memcpy, causing a second, larger overflow (up to ~243 bytes past the buffer).

A malicious nearby BR/EDR Bluetooth peripheral can exploit this by sending a crafted AVRCP player-settings response once a victim device reaches player-settings discovery, corrupting adjacent stack memory in the root-owned bluetoothd daemon and potentially achieving code execution.

Reported by Alexandro Calò of Nozomi Networks Labs (advisory NN-2026-0145).

Reference: https://github.com/bluez/bluez/security/advisories/GHSA-m2vx-pw5f-rc8v