CVE-2026-80186— Bluez: stack overflow in name2utf8 causes dos and potential code execution
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 蓝牙协议栈 BlueZ 中存在一个基于栈的缓冲区溢出漏洞。处于蓝牙无线电范围内的远程用户可发送精心构造的扩展查询响应（EIR）数据包，当目标设备执行蓝牙发现时，该数据包会引发缓冲区溢出。此漏洞可能导致蓝牙守护进程（bluetoothd）服务崩溃，从而造成拒绝服务（DoS），并可能允许攻击者执行任意代码。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80186
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bluez: stack overflow in name2utf8 causes dos and potential code execution
Source: CVE Program / CVE List V5
Vulnerability Description
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-80186
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 9414 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-80186
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-80186 (3)
-
-
-
🔗 2524132 – (CVE-2026-80186) CVE-2026-80186 bluez: Stack Overflow in name2utf8 causes DoS and potential code execution issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-08-25 · 10 CVEs total
| CVE-2026-79992 | 7.8 HIGH | Emacs: local shell command injection through the user field in emacs tramp |
| CVE-2026-79655 | 7.8 HIGH | Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targ |
| CVE-2026-78701 | 6.5 MEDIUM | 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall d |
| CVE-2026-78322 | 6.5 MEDIUM | File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar hand |
| CVE-2026-79717 | 6.4 MEDIUM | Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrict |
| CVE-2026-79652 | 5.9 MEDIUM | Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce cons |
| CVE-2026-80185 | 5.7 MEDIUM | Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary cod |
| CVE-2026-77680 | 5.3 MEDIUM | Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025 |
| CVE-2026-80101 | 4.4 MEDIUM | Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-l |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-80185
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent- -
CVE-2026-77680
Libsoup3: libsoup: quadratic cpu denial of service in http r -
CVE-2026-79992
Emacs: local shell command injection through the user field -
CVE-2026-79655
Sos: sos: path traversal in sos clean tar extraction via unv -
CVE-2026-19685
Networkmanager: networkmanager: 802-1x ca-path and phase2-ca
Same vendor: Red Hat
-
CVE-2026-79654
Ketello: katello content view history api cross-organization -
CVE-2026-80185
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent- -
CVE-2026-80101
Gimp: multiple heap out-of-bounds reads in xwd loader from u -
CVE-2026-77680
Libsoup3: libsoup: quadratic cpu denial of service in http r -
CVE-2026-79992
Emacs: local shell command injection through the user field
Same weakness: CWE-120
-
CVE-2026-71399
Adobe XD | Buffer Overflow (CWE-120) -
CVE-2026-78322
File-roller: file-roller: stack buffer overflow in parse_pro -
CVE-2026-19568
SVG File Parsing Memory Corruption Vulnerability in Autodesk -
CVE-2026-71942
DrayTek VigorSwitch Multiple Models Buffer Overflow via mail -
CVE-2026-71941
DrayTek VigorSwitch Multiple Models Buffer Overflow via diag
V. Comments for CVE-2026-80186
No comments yet