CVE-2026-93015 BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write
A remote attacker can cause out-of-bounds writes and potential code execution by sending malformed A2DP discovery responses to devices using the BTstack library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93015?
CVE-2026-93015 is a high-severity memory corruption vulnerability in BlueKitchen GmbH BTstack, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.
Which versions are affected by CVE-2026-93015?
How do I fix CVE-2026-93015?
No fix has been published for CVE-2026-93015 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-93015 being exploited?
There is no known exploitation of CVE-2026-93015 in the wild and no public exploit code.
Sources
Also known as GHSA-8jfq-vh53-xqf3.