An out-of-bounds read vulnerability in the AVRCP Browsing Target GET_FOLDER_ITEMS handler allows a paired Bluetooth Classic attacker to supply an invalid attr_id value, resulting in a memory read outside the intended buffer and corrupting the attribute bitmap state. This can lead to application crashes or unstable operation, which constitutes a denial of service.

Vendor BlueKitchen GmbH provides the BTstack firmware. Versions earlier than 1.8.1 are affected, including releases that have not yet incorporated the 1.8.1 fix. Devices or software relying on the older BTstack will be vulnerable.

With a CVSS score of 2.1 the vulnerability is considered low severity, and an EPSS score below 1% indicates very low likelihood of exploitation in the wild. It is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be within Bluetooth range and possess pairing credentials to establish a Bluetooth Classic connection with the target device. Because the attack vector relies on proximity and an existing pairing, the risk to unpaired devices is limited, but any device exposed to the public Bluetooth environment remains vulnerable to a local denial of service attack.