CVE-2026-93015
BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery.
CVSS
6.3
Medio
EPSS
0.2%
p16
KEV
—
Exploit Today
5
0-100
Publicado: 17 sept 2026 · Última mod.: 17 sept 2026 · CWE-787 · CWE-1284
Sin historial EPSS suficiente todavía.
BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery.
- github.comhttps://github.com/bluekitchen/btstack
- github.comhttps://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/a2dp.c#L568
- github.comhttps://github.com/bluekitchen/btstack/blob/v1.8.2/src/classic/avdtp.c#L1703
- github.comhttps://github.com/bluekitchen/btstack/commit/fc208fcce056d4e0a5bb916abc90e83a383e1cdf
- www.vulncheck.comhttps://www.vulncheck.com/advisories/bluekitchen-btstack-through-1.8.2-a2dp-sep-discovery-out-of-bounds-write
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-928806.3 MED16.4%
——5A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entries causes out-of-bounds write. Remote exploitation of the attack is possible. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is suggested to install a patch to address this issue.1dCVE-2026-252807.8 ALT1.5%
——0Memory corruption when processing escape handling flow with insufficient user buffer sizes.2hCVE-2026-240747.8 ALT5.8%
——2Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.2hCVE-2026-240737.8 ALT5.8%
——2Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.2hCVE-2026-927867.8 ALT2.8%
——1LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.2dCVE-2026-91097—50.5%
——15HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.2d