{"id":"CVE-2026-118608","kind":"vulnerability","aliases":["CVE-2026-118608"],"related":[],"title":"Alpine iLX-F511 Bluetooth stack reads past buffer, leaks memory","description":"Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the prh_rfcomm_cc_process_test function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-29018.","summary":"The libanwbtstack.so Bluetooth component on Alpine iLX-F511 car head units reads past the end of an allocated buffer in prh_rfcomm_cc_process_test when handling data from a paired device. An attacker who can pair a malicious Bluetooth device can disclose sensitive information, and could chain it with other flaws to run code as root.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alpine","automotive","bluetooth","ilx-f511","infrastructure"],"not_affected_if":["no-alpine-ilx-f511"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:43+00:00","updated_at":"2026-10-28T17:34:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T17:34:43Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Alpine iLX-F511 Bluetooth stack reads past buffer, leaks memory","impact":"low","summary":"The libanwbtstack.so Bluetooth component on Alpine iLX-F511 car head units reads past the end of an allocated buffer in prh_rfcomm_cc_process_test when handling data from a paired device. An attacker who can pair a malicious Bluetooth device can disclose sensitive information, and could chain it with other flaws to run code as root.","category":"infrastructure","nicknames":[],"who_cares":["alpine","ilx-f511","automotive","bluetooth"],"confidence":0.6,"needs_auth":"no","worst_case":"Sensitive memory leaks; chained with other flaws, code runs as root","analyst_note":"Find the affected firmware versions and the vendor fix from the ZDI advisory (ZDI-CAN-29018) or Alpine's notice, since the sources give neither.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-alpine-ilx-f511"],"who_is_affected":"Owners of Alpine iLX-F511 head units with the affected libanwbtstack.so Bluetooth stack are exposed, and only if an attacker can pair a device with the unit. The sources do not give affected firmware versions. Systems without this device can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000608,"input_tokens":3508,"output_tokens":514,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-118608':14A,17A '-2026':13A,16A '29018':206C 'abil':127C 'adjac':106C 'affect':113C 'alloc':43B,181C 'allow':103C 'alpin':1A,18B,30B,83C,116C 'arbitrari':195C 'attack':59B,107C,122C,184C 'automot':19B 'bluetooth':5A,20B,27B,65B,132C 'bound':96C 'buffer':9A,44B,182C 'car':34B 'cc':48B,90C,152C 'chain':73B 'code':80B,196C 'compon':28B 'conjunct':189C 'context':199C 'could':72B 'cve':12A,15A 'data':53B,169C 'devic':57B,66B,120C,133C 'disclos':68B,109C 'disclosur':99C 'end':40B,178C 'execut':194C 'exist':147C 'exploit':141C 'f511':4A,23B,33B,86C,119C 'first':124C 'flaw':77B,146C 'function':155C 'handl':52B 'head':35B 'ilx':3A,22B,32B,85C,118C 'ilx-f511':2A,21B,31B,84C,117C 'inform':70B,98C,111C 'infrastructur':24B 'instal':114C 'issu':157C 'lack':161C 'leak':10A 'leverag':186C 'libanwbtstack.so':26B,87C 'malici':64B,131C 'memori':11A 'must':123C 'network':105C 'network-adjac':104C 'obtain':125C 'order':139C 'out-of-bound':93C 'pair':56B,62B,129C 'past':8A,38B,176C 'prh':46B,88C,150C 'process':49B,91C,153C 'proper':163C 'read':7A,37B,97C,175C 'result':158C,172C 'rfcomm':47B,89C,151C 'root':82B,201C 'run':79B 'sensit':69B,110C 'specif':145C 'stack':6A 'suppli':168C 'system':137C 'target':136C 'test':50B,92C,154C 'unit':36B 'user':167C 'user-suppli':166C 'valid':164C 'vulner':100C,102C,143C,192C 'within':148C 'zdi':204C 'zdi-can':203C","nicknames":[],"mitigations":[],"who_affected":"Owners of Alpine iLX-F511 head units with the affected libanwbtstack.so Bluetooth stack are exposed, and only if an attacker can pair a device with the unit. The sources do not give affected firmware versions. Systems without this device can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118608","severity":null,"published_at":"2026-10-28T17:18:27+00:00","modified_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}