CVE-2026-101887— BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS
Quick assessment
Affected
arkq bluez-alsa
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BlueALSA（bluez-alsa/bluealsad）在 LC3plus 接收端解码器中存在一个除以零漏洞（位于 a2dp-lc3plus.c 文件中的 a2dp_lc3plus_dec_thread 函数）。该漏洞允许处于蓝牙邻近位置的攻击者通过发送一个精心构造的 RTP 媒体头，并将其中由攻击者控制的帧计数字段设置为零，从而引发守护进程崩溃。 具体而言，攻击者可先与运行 bluealsad 作为 A2DP 接收端的受害者建立 A2DP 源连接，并协商使用 LC3plus 会话；随后传输一个未分片的、帧计数
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-101887
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS
Source: CVE Program / CVE List V5
Vulnerability Description
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
除零错误
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| arkq | bluez-alsa | 0 ~ 1a84465dd860d1be9dcf62339c6273e9e0632dd2 | - |
|
II. Public POCs for CVE-2026-101887
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-101887
请登录查看更多情报信息。
Other References for CVE-2026-101887 (2)
IV. Related Vulnerabilities
Same weakness: CWE-369
-
CVE-2026-47534
NVIDIA驱动内核层除零漏洞致拒绝服务 -
CVE-2026-93589
ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder -
CVE-2026-92881
vgmstream AWB parser awb.c init_vgmstream_awb_memory divide -
CVE-2026-91955
FreeRDP before 3.31.0 Denial of Service via Desktop Dimensio -
CVE-2026-15417
CP210x Denial of Service
V. Comments for CVE-2026-101887
No comments yet