{"id":"CVE-2026-118604","kind":"vulnerability","aliases":["CVE-2026-118604"],"related":[],"title":"Alpine iLX-F511 car head unit: stack overflow lets physical attacker run root code","description":"Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the framework service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29007.","summary":"The framework service on Alpine iLX-F511 devices copies user-supplied data into a fixed-length stack buffer without checking its length. A physically present attacker can exploit this to execute arbitrary code as root.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alpine-ilx-f511","embedded","infrastructure","iot"],"not_affected_if":["no-physical-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:36+00:00","updated_at":"2026-10-28T17:34:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T17:34:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Alpine iLX-F511 car head unit: stack overflow lets physical attacker run root code","impact":"high","summary":"The framework service on Alpine iLX-F511 devices copies user-supplied data into a fixed-length stack buffer without checking its length. A physically present attacker can exploit this to execute arbitrary code as root.","category":"infrastructure","nicknames":[],"who_cares":["alpine-ilx-f511","embedded","iot"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as root on the device","analyst_note":"Find the vendor advisory or firmware version list and the exact physical vector (USB, Bluetooth, or serial) at https://nvd.nist.gov/vuln/detail/CVE-2026-118604 and the ZDI advisory for ZDI-CAN-29007.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-physical-access"],"who_is_affected":"Owners and installers of Alpine iLX-F511 units with the affected firmware. The sources describe a physical-presence attack and do not name affected firmware versions, so the exposure window is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000574,"input_tokens":3425,"output_tokens":462,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118604':18A,21A '-2026':17A,20A '29007':165C 'affect':93C 'allow':84C 'alpin':1A,23B,33B,67C,96C 'alpine-ilx-f511':22B 'arbitrari':63B,90C 'attack':12A,57B,87C,148C 'authent':101C 'base':75C,145C 'buffer':49B,76C,146C 'car':5A 'check':51B 'code':15A,64B,79C,91C,155C 'context':158C 'copi':38B,136C 'cve':16A,19A 'data':42B,133C 'devic':37B,100C 'embed':26B 'execut':62B,80C,89C,154C 'exist':112C 'exploit':59B,106C 'f511':4A,25B,36B,70C,99C 'fix':46B,141C 'fixed-length':45B,140C 'flaw':111C 'framework':30B,71C,115C 'head':6A 'ilx':3A,24B,35B,69C,98C 'ilx-f511':2A,34B,68C,97C 'infrastructur':27B 'instal':94C 'iot':28B 'issu':118C 'lack':122C 'length':47B,53B,128C,142C 'let':10A 'leverag':150C 'overflow':9A,77C 'physic':11A,55B,85C 'present':56B,86C 'prior':134C 'proper':124C 'remot':78C 'requir':104C 'result':119C 'root':14A,66B,160C 'run':13A 'servic':31B,72C,116C 'specif':110C 'stack':8A,48B,74C,144C 'stack-bas':73C,143C 'suppli':41B,132C 'unit':7A 'user':40B,131C 'user-suppli':39B,130C 'valid':125C 'vulner':81C,83C,108C,152C 'within':113C 'without':50B 'zdi':163C 'zdi-can':162C","nicknames":[],"mitigations":[],"who_affected":"Owners and installers of Alpine iLX-F511 units with the affected firmware. The sources describe a physical-presence attack and do not name affected firmware versions, so the exposure window is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118604","severity":null,"published_at":"2026-10-28T17:18:27+00:00","modified_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}