CVE-2026-93015

Name of the Vulnerable Software and Affected Versions BlueKitchen BTstack versions prior to 1.8.3

Description An issue exists in A2DP stream endpoint discovery where the software fails to validate the peer-reported endpoint count against table bounds. A bonded peer can send an AVDTP DISCOVER response containing more endpoints than the fixed table can hold, leading to out-of-bounds writes. This memory corruption affects adjacent static objects, which can result in a process crash or the severance of event delivery.

Recommendations Update BlueKitchen BTstack to version 1.8.3 or later.