The flaw enables a nearby attacker with a paired Bluetooth Classic connection to send a crafted VENDOR_DEPENDENT response that contains an attacker‑controlled count. In the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers this triggers an out‑of‑bounds read from the L2CAP receive buffer, potentially exposing data beyond the intended buffer and causing a crash on resource‑constrained devices, effectively denying service.

All releases of BlueKitchen GmbH BTstack prior to version 1.8.1 are affected. Devices or embedded products that embed BTstack 1.8.0 or earlier and maintain a Bluetooth Classic pairing with another device are vulnerable.

The CVSS score of 2.1 combined with an EPSS value below 1 % indicates low severity and a very small likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires physical proximity and an existing Bluetooth Classic pairing, limiting the threat surface. While the crash could interrupt device operation, widespread impact is unlikely without a more active payload.