BlueKitchen BTstack versions before 1.8.1 expose a buffer over-read in the AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_ATTRIBUTES and LIST_PLAYER_APPLICATION_SETTING_VALUES handlers. A crafted VENDOR_DEPENDENT response containing an attacker‑controlled count value can cause the stack to read beyond the bounds of the L2CAP receive buffer, potentially triggering a crash on devices with limited resources.

The vulnerability affects any deployment of BlueKitchen BTstack older than version 1.8.1. Systems that use the AVRCP Controller functionality and accept dynamically generated attribute lists are susceptible. This includes embedded Bluetooth Classic modules on consumer electronics, automotive infotainment systems, and IoT devices that incorporate the affected BTstack libraries.

The CVSS score of 2.1 indicates low severity, and the vulnerability is only exploitable by a nearby attacker who has an active paired Bluetooth Classic connection. While this does not compromise confidentiality or integrity, the out-of-bounds read may lead to a denial‑of‑service by crashing the device. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Nonetheless, because the attack requires local proximity and pairing, it represents a real risk for embedded or low‑resource devices where stability is critical.