Packages
- bluez - Bluetooth tools and daemons
Details
Michael Bommarito discovered that BlueZ incorrectly handled codec
capability storage in the A2DP profile. An attacker could possibly
use this issue to cause a stack buffer overflow, resulting in a denial
of service or arbitrary code execution. This issue only affected Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-19774)
It was discovered that BlueZ incorrectly handled packet length validation.
An attacker could possibly use this issue to read out of bounds memory,
causing a crash or exposing sensitive information. (CVE-2026-75032)
It was discovered that BlueZ incorrectly handled crafted XML input. An
attacker could possibly use this issue to crash BlueZ, resulting in a
denial of service. (CVE-2026-80185)
It was discovered that BlueZ incorrectly parsed remote names from...
Michael Bommarito discovered that BlueZ incorrectly handled codec
capability storage in the A2DP profile. An attacker could possibly
use this issue to cause a stack buffer overflow, resulting in a denial
of service or arbitrary code execution. This issue only affected Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-19774)
It was discovered that BlueZ incorrectly handled packet length validation.
An attacker could possibly use this issue to read out of bounds memory,
causing a crash or exposing sensitive information. (CVE-2026-75032)
It was discovered that BlueZ incorrectly handled crafted XML input. An
attacker could possibly use this issue to crash BlueZ, resulting in a
denial of service. (CVE-2026-80185)
It was discovered that BlueZ incorrectly parsed remote names from Extended
Inquiry Response data. An attacker could possibly use this issue to cause a
stack buffer overflow, resulting in a denial of service or arbitrary code
execution. (CVE-2026-80186)
Alexandro Calo discovered that BlueZ incorrectly parsed certain responses
in the AVRCP profile. An attacker could possibly use this issue to access
out of bounds memory, causing a crash or exposing sensitive information.
(CVE-2026-85218)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.04 LTS resolute | bluez – 5.85-4ubuntu0.3 | ||
| 24.04 LTS noble | bluez – 5.72-0ubuntu5.7 | ||
| 22.04 LTS jammy | bluez – 5.64-0ubuntu1.5 | ||
| 20.04 LTS focal | bluez – 5.53-0ubuntu3.9+esm1 | ||
| 18.04 LTS bionic | bluez – 5.48-0ubuntu3.9+esm3 | ||
| 16.04 LTS xenial | bluez – 5.37-0ubuntu5.3+esm6 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.