{"id":"CVE-2026-118605","kind":"vulnerability","aliases":["CVE-2026-118605"],"related":[],"title":"Alpine iLX-F511 car head unit: Bluetooth pairing flaw lets attackers run code as root","description":"Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the prh_sdp_service_search_decode function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29069.","summary":"A stack-based buffer overflow in the Bluetooth SDP service search decoder of the Alpine iLX-F511 head unit lets a nearby attacker who can pair a malicious Bluetooth device overwrite memory. The attacker can execute arbitrary code as root on the device.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alpine","automotive","bluetooth","ilx-f511","infrastructure"],"not_affected_if":["no-ilx-f511-device"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:25+00:00","updated_at":"2026-10-28T17:34:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T17:34:25Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Alpine iLX-F511 car head unit: Bluetooth pairing flaw lets attackers run code as root","impact":"high","summary":"A stack-based buffer overflow in the Bluetooth SDP service search decoder of the Alpine iLX-F511 head unit lets a nearby attacker who can pair a malicious Bluetooth device overwrite memory. The attacker can execute arbitrary code as root on the device.","category":"infrastructure","nicknames":[],"who_cares":["alpine","ilx-f511","automotive","bluetooth"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as root on the head unit.","analyst_note":"Find the affected firmware versions and the vendor fix from the ZDI advisory (ZDI-CAN-29069) or Alpine's support pages; the NVD entry does not list them.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-ilx-f511-device"],"who_is_affected":"Owners and fleet operators of Alpine iLX-F511 head units with Bluetooth enabled are affected, since the flaw is reached by pairing a malicious Bluetooth device. The sources do not state the firmware versions that are vulnerable or fixed. Systems without an iLX-F511 unit can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000604,"input_tokens":3474,"output_tokens":514,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118605':19A,22A '-2026':18A,21A '29069':193C 'abil':119C 'adjac':98C 'affect':105C 'allow':95C 'alpin':1A,23B,45B,75C,108C 'arbitrari':68B,102C 'attack':12A,54B,65B,99C,114C,176C 'automot':24B 'base':33B,86C,173C 'bluetooth':8A,25B,38B,60B,124C 'buffer':34B,87C,174C 'car':5A 'code':14A,69B,90C,103C,183C 'context':186C 'copi':167C 'cve':17A,20A 'data':164C 'decod':42B,83C,146C 'devic':61B,74B,112C,125C 'execut':67B,91C,101C,182C 'exist':139C 'exploit':133C 'f511':4A,28B,48B,78C,111C 'first':116C 'flaw':10A,138C 'function':147C 'head':6A,49B 'ilx':3A,27B,47B,77C,110C 'ilx-f511':2A,26B,46B,76C,109C 'infrastructur':29B 'instal':106C 'issu':149C 'lack':153C 'length':159C 'let':11A,51B 'leverag':178C 'malici':59B,123C 'memori':63B 'must':115C 'nearbi':53B 'network':97C 'network-adjac':96C 'obtain':117C 'order':131C 'overflow':35B,88C 'overwrit':62B 'pair':9A,57B,121C 'prh':79C,142C 'prior':165C 'proper':155C 'remot':89C 'result':150C 'root':16A,71B,188C 'run':13A 'sdp':39B,80C,143C 'search':41B,82C,145C 'servic':40B,81C,144C 'specif':137C 'stack':32B,85C,172C 'stack-bas':31B,84C,171C 'suppli':163C 'system':129C 'target':128C 'unit':7A,50B 'user':162C 'user-suppli':161C 'valid':156C 'vulner':92C,94C,135C,180C 'within':140C 'zdi':191C 'zdi-can':190C","nicknames":[],"mitigations":[],"who_affected":"Owners and fleet operators of Alpine iLX-F511 head units with Bluetooth enabled are affected, since the flaw is reached by pairing a malicious Bluetooth device. The sources do not state the firmware versions that are vulnerable or fixed. Systems without an iLX-F511 unit can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118605","severity":null,"published_at":"2026-10-28T17:18:27+00:00","modified_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}