Description
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.
Published: 2026-10-01
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A division‑by‑zero flaw exists in the LC3plus sink decoder of BlueALSA. When a crafted RTP media header sets the frame count to zero, the decoding thread receives a SIGFPE, causing the daemon to crash. The vulnerability is classified as a CWE-369 issue and results in a denial‑of‑service condition on systems compiled with LC3plus support enabled.

Affected Systems

The affected component is BlueALSA, a Bluetooth audio stack from the arkq project. The issue arises in builds of bluez-alsa/bluealsad that are compiled with LC3plus support. No specific version numbers are listed, so any installation that includes LC3plus decoding is potentially vulnerable.

Risk and Exploitability

With a CVSS score of 2.1 the severity is low; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a Bluetooth‑adjacent attacker to act as an A2DP source and transmit a single crafted media header. Thus the attack vector is a proximity‑based Bluetooth connection, and while it can cause a local denial‑of‑service, the overall likelihood of exploitation is modest.

Generated by OpenCVE AI on October 1, 2026 at 03:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade BlueALSA to a version that resolves the division‑by‑zero flaw.
  • If an upgrade cannot be performed, disable LC3plus support in the BlueALSA configuration to eliminate the vulnerable code path.
  • Restrict device pairing to trusted Bluetooth devices and monitor for abnormal media header traffic.

Generated by OpenCVE AI on October 1, 2026 at 03:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Arkq
Arkq bluez-alsa
Vendors & Products Arkq
Arkq bluez-alsa

Thu, 01 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Description BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.
Title BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS
Weaknesses CWE-369
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Arkq Bluez-alsa
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-01T19:04:17.577Z

Reserved: 2026-09-28T15:44:45.390Z

Link: CVE-2026-101887

cve-icon Vulnrichment

Updated: 2026-10-01T19:01:30.437Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-01T03:16:58.493

Modified: 2026-10-01T20:17:20.953

Link: CVE-2026-101887

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:37:57Z

Weaknesses