CVE-2026-28528: Out-of-Bounds Read in BTstack Bluetooth Stack

An attacker exploiting this vulnerability could leverage a paired Bluetooth Classic connection to send crafted packets to the BTstack AVRCP Browsing Target GETFOLDERITEMS handler. The handler fails to properly validate packet boundaries and attribute count data, leading to an out-of-bounds read. This can result in a denial-of-service (DoS) attack by crashing the affected system. Furthermore, the attacker could potentially corrupt the attribute bitmap state, leading to unpredictable behavior or even allowing for unauthorized access to Bluetooth functionality. While the vulnerability requires a paired connection, the potential for system crashes and attribute corruption represents a significant security risk.

1. Reserved2026-02-27
2. Published2026-03-30
3. EPSS updated2026-04-07

The primary mitigation for CVE-2026-28528 is to upgrade to BTstack version 1.8.1 or later, which contains the fix for the out-of-bounds read vulnerability. If an immediate upgrade is not feasible, consider implementing Bluetooth connection restrictions to limit pairing with untrusted devices. While a direct WAF or proxy rule is unlikely to be effective, monitoring Bluetooth connection attempts and traffic patterns for anomalies could provide an early warning sign of potential exploitation. After upgrading, confirm the fix by attempting to trigger the AVRCP GETFOLDERITEMS handler with malformed packets and verifying that the system does not crash or exhibit unexpected behavior.