Live › vulnerability › CVE-2026-118603
Go to dashboardA stack-based buffer overflow in how the Alpine iLX-F511 head unit parses vCard data lets an attacker run arbitrary code with root privileges. The attack needs the head unit to connect to a malicious Bluetooth device, which is a user action.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Owners of Alpine iLX-F511 head units are affected when the unit processes vCard data from a Bluetooth device. Fleet or product teams that ship or support this hardware should look at it; teams with no Alpine iLX-F511 units can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.
The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29017.
This page as .md · .json · in your agent: get_signal("CVE-2026-118603")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.