Description
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
Published: 2026-08-25
Score: 5.7 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

BlueZ’s sdp-xml.c contains a type‑confusion flaw that is triggered via the RegisterProfile(ServiceRecord) API. A crafted nested ServiceRecord corrupts the SDP XML parser’s stack, causing scalar union data to be interpreted as a sequence pointer. The resulting memory corruption crashes the bluetoothd daemon, leading to a local denial of service that can affect any user able to register a profile on the machine. The vulnerability is classified as CWE‑843.

Affected Systems

Systems running Red Hat Enterprise Linux 6, 7, 8, 9 or 10 with BlueZ 5.86 are affected. Any host that exposes the Bluetooth daemon on a local interface and allows users to register profiles can be impacted.

Risk and Exploitability

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is local: an unprivileged user who can invoke RegisterProfile can trigger the daemon crash. Because the impact is limited to service availability and does not provide code execution or elevation, the overall risk is moderate but remains significant for uptime and stability.

Generated by OpenCVE AI on August 26, 2026 at 02:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Red Hat security update that patches BlueZ 5.86 to eliminate the type‑confusion flaw.
  • If Bluetooth is not required for the host’s operation, disable or stop the bluetoothd service to remove the attack surface.
  • Continuously monitor system logs for repeated bluetoothd crash events as an early indicator of abuse or failure to patch.

Generated by OpenCVE AI on August 26, 2026 at 02:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 25 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
Title Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-843
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 5.7, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-25T21:58:16.883Z

Reserved: 2026-08-25T21:43:59.387Z

Link: CVE-2026-80185

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T22:17:07.427

Modified: 2026-08-25T22:17:07.427

Link: CVE-2026-80185

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-25T00:00:00Z

Links: CVE-2026-80185 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T02:30:04Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')