A double stack-based buffer overflow exists in the BlueZ AVRCP controller implementation. A nearby peripheral can send a crafted AVRCP player‑settings response that supplies an attacker‑controlled attribute count, causing avrcp_list_player_attributes_rsp() and avrcp_get_current_player_value() in profiles/audio/avrcp.c to write past fixed‑size stack buffers, potentially leading to a crash or code execution in the bluetoothd daemon. This is a classic stack-based buffer overflow weakness.

The vulnerability affects systems that run the BlueZ Bluetooth stack, the default implementation on most Linux distributions. No specific version range is supplied in the advisory, so any installation of BlueZ that has not incorporated the fix may be vulnerable.

The CVSS score of 7.1 indicates a high severity. The likely attack vector is an attacker who can communicate with the target device over Bluetooth, typically from a nearby peripheral, sending a malicious AVRCP response. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but because it can lead to code execution and the lack of obvious mitigations, the risk remains significant in environments where Bluetooth devices are connected.