{"id":"CVE-2026-93015","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-93015","summary":"BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER…","details":"BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.","published":"2026-09-17T15:16:52.858Z","modified":"2026-09-17T15:16:52.858Z","cvss":{"score":6.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/bluekitchen/btstack/commit/fc208fcce056d4e0a5bb916abc90e83a383e1cdf","label":"bluekitchen/btstack@fc208fc"},"references":[{"type":"FIX","url":"https://github.com/bluekitchen/btstack/commit/fc208fcce056d4e0a5bb916abc90e83a383e1cdf"},{"type":"WEB","url":"https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/a2dp.c#L568"},{"type":"WEB","url":"https://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/avdtp.c#L1703"},{"type":"WEB","url":"https://github.com/bluekitchen/btstack"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/bluekitchen-btstack-through-1.8.2-a2dp-sep-discovery-out-of-bounds-write"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-17T15:16:52.858Z"}}