CVE-2026-28528 is an out-of-bounds read vulnerability in BlueKitchen BTstack versions prior to 1.8.1. The vulnerability exists in the AVRCP Browsing Target GET_FOLDER_ITEMS handler, which fails to validate packet boundaries and attribute count data. An attacker with a paired Bluetooth Classic connection can exploit insufficient bounds checking on the attr_id parameter to cause crashes and corrupt attribut [truncated]
CVE-2026-28527 is an out-of-bounds read vulnerability in BlueKitchen BTstack versions prior to 1.8.1. The vulnerability exists in the AVRCP Controller GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT and GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT handlers, allowing nearby attackers to read beyond packet boundaries. Attackers can establish a paired Bluetooth Classic connection and send specially crafted VENDOR [truncated]
