CVE WatchSep 17, 2026

CVE-2026-93015

BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery.

CVSS

6.3

Medium

EPSS

0.2%

p16

KEV

—

Exploit Today

0-100

Published: Sep 17, 2026 · Last modified: Sep 17, 2026 · CWE-787 · CWE-1284

EPSS · 30d

Not enough EPSS history yet.

Technical description

BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-928806.3 MED

16.4%

——5A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue.1d CVE-2026-252807.8 HIG

1.5%

——0Memory corruption when processing escape handling flow with insufficient user buffer sizes.2h CVE-2026-240747.8 HIG

5.8%

——2Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.2h CVE-2026-240737.8 HIG

5.8%

——2Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.2h CVE-2026-927867.8 HIG

2.8%

——1LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.2d CVE-2026-91097—

50.5%

——15HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.2d