CVE-2026-19774

A flaw was found in BlueZ. This vulnerability, a stack-based buffer overflow in the Advanced Audio Distribution Profile (A2DP) stack, allows a network-adjacent attacker to execute arbitrary code. By pairing a malicious Bluetooth device with the target system, an attacker can exploit improper validation of user-supplied data length. Successful exploitation leads to arbitrary code execution with root privileges.

This vulnerability is rated as Important severity rather than Critical because exploitation is bounded to adjacent Bluetooth range and requires pairing a rogue device with the host, despite resulting in elevated root execution. In standard Red Hat Enterprise Linux server environments, Bluetooth controllers are rarely equipped or the bluetooth daemon is inactive by default, significantly reducing practical risk. Exposure is largely confined to workstation deployments or systems with an active Bluetooth interface accepting device connections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable the Bluetooth service if it is not required. This can be achieved by stopping and disabling the bluetooth service.

sudo systemctl stop bluetooth
sudo systemctl disable bluetooth

Disabling the Bluetooth service will prevent all Bluetooth functionality on the system. A system reboot may be required for the changes to take full effect.