PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28527 BlueKitchen GmbH CVE debrief

CVE-2026-28527 is an out-of-bounds read vulnerability in BlueKitchen BTstack versions prior to 1.8.1. The vulnerability exists in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers, allowing nearby attackers to read beyond packet boundaries. Attackers can establish a paired Bluetooth Classic connection and send specially crafted VENDOR_DEPENDENT responses to trigger out-of-bounds reads, causing information disclosure and potential crashes on affected devices. Organizations should be aware of this vulnerability and take steps to mitigate it.

Vendor
BlueKitchen GmbH
Product
BTstack
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-30
Original CVE updated
2026-07-14
Advisory published
2026-03-30
Advisory updated
2026-07-14

Who should care

Organizations using BlueKitchen BTstack versions prior to 1.8.1 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 1.8.1 or later, and implementing compensating controls such as monitoring for suspicious Bluetooth activity. Operators, platforms, vulnerability-management teams, and security teams may be impacted.

Technical summary

The vulnerability is caused by an out-of-bounds read in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers. This allows attackers to read beyond packet boundaries, potentially causing information disclosure and crashes. The vulnerability can be exploited by establishing a paired Bluetooth Classic connection and sending specially crafted VENDOR_DEPENDENT responses. Affected product deployments should be identified and owners assigned for follow-up.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to BlueKitchen BTstack version 1.8.1 or later
  • Implement compensating controls such as monitoring for suspicious Bluetooth activity
  • Conduct regular inventory checks to ensure all devices are running the latest version of BTstack
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-03-30T14:16:35.003Z and was last modified on 2026-07-14T19:16:54.327Z. The NVD entry is currently Analyzed. This information is based on the CVE record and NVD entry. Defenders should verify the accuracy of this information and review official advisories for further details.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-30T14:16:35.003Z and has not been modified since then. The NVD entry is currently Analyzed.