{"id":"CVE-2026-118610","kind":"vulnerability","aliases":["CVE-2026-118610"],"related":[],"title":"Alpine iLX-F511 car stereo: Android Auto service lets network attacker run root code","description":"Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the Android Auto service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29015.","summary":"The Alpine iLX-F511 head unit's Android Auto service copies user-supplied data into a fixed-size stack buffer without checking its length. A network-adjacent attacker can overflow that buffer and execute arbitrary code as root, without authentication.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alpine","android-auto","automotive","embedded","ilx-f511","infrastructure"],"not_affected_if":["android-auto-unused"],"how_to_check":"- Check the head unit's firmware version in its settings menu against the vendor advisory; the sources do not give a version string\n- unknown for any other check","fix":"- unknown: the sources do not name a fixed firmware version or vendor patch; check Alpine's support site for an update to the iLX-F511 firmware","status":"open","published_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","triaged_at":"2026-10-28T17:34:14+00:00","updated_at":"2026-10-28T17:34:14+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T17:34:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed firmware version or vendor patch; check Alpine's support site for an update to the iLX-F511 firmware","reach":"network","title":"Alpine iLX-F511 car stereo: Android Auto service lets network attacker run root code","impact":"high","summary":"The Alpine iLX-F511 head unit's Android Auto service copies user-supplied data into a fixed-size stack buffer without checking its length. A network-adjacent attacker can overflow that buffer and execute arbitrary code as root, without authentication.","category":"infrastructure","nicknames":[],"who_cares":["alpine","ilx-f511","android-auto","automotive","embedded"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as root on the head unit","analyst_note":"Find the vendor advisory or ZDI page (ZDI-CAN-29015) for the fixed firmware version and whether Android Auto must be enabled.","how_to_check":"- Check the head unit's firmware version in its settings menu against the vendor advisory; the sources do not give a version string\n- unknown for any other check","needs_analyst":true,"not_affected_if":["android-auto-unused"],"who_is_affected":"Owners of Alpine iLX-F511 head units that use the Android Auto feature are exposed. The sources describe a network-adjacent attack, so the risk depends on how close an attacker can get to the unit's network link. Units without Android Auto use, or with the feature disabled, are likely not exposed, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000633,"input_tokens":3434,"output_tokens":580,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118610':18A,21A '-2026':17A,20A '29015':177C 'adjac':62B,97C 'affect':104C 'allow':94C 'alpin':1A,22B,33B,76C,107C 'android':7A,24B,40B,80C,126C 'android-auto':23B 'arbitrari':70B,101C 'attack':12A,63B,98C,160C 'authent':75B,112C 'auto':8A,25B,41B,81C,127C 'automot':26B 'base':85C,157C 'buffer':54B,67B,86C,158C 'car':5A 'check':56B 'code':15A,71B,89C,102C,167C 'context':170C 'copi':43B,148C 'cve':16A,19A 'data':47B,145C 'devic':111C 'embed':27B 'execut':69B,90C,100C,166C 'exist':123C 'exploit':117C 'f511':4A,30B,36B,79C,110C 'fix':51B,153C 'fixed-length':152C 'fixed-s':50B 'flaw':122C 'head':37B 'ilx':3A,29B,35B,78C,109C 'ilx-f511':2A,28B,34B,77C,108C 'infrastructur':31B 'instal':105C 'issu':130C 'lack':134C 'length':58B,140C,154C 'let':10A 'leverag':162C 'network':11A,61B,96C 'network-adjac':60B,95C 'overflow':65B,87C 'prior':146C 'proper':136C 'remot':88C 'requir':115C 'result':131C 'root':14A,73B,172C 'run':13A 'servic':9A,42B,82C,128C 'size':52B 'specif':121C 'stack':53B,84C,156C 'stack-bas':83C,155C 'stereo':6A 'suppli':46B,144C 'unit':38B 'user':45B,143C 'user-suppli':44B,142C 'valid':137C 'vulner':91C,93C,119C,164C 'within':124C 'without':55B,74B 'zdi':175C 'zdi-can':174C","nicknames":[],"mitigations":[],"who_affected":"Owners of Alpine iLX-F511 head units that use the Android Auto feature are exposed. The sources describe a network-adjacent attack, so the risk depends on how close an attacker can get to the unit's network link. Units without Android Auto use, or with the feature disabled, are likely not exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118610","severity":null,"published_at":"2026-10-28T17:18:28+00:00","modified_at":"2026-10-28T17:18:28+00:00","first_seen_at":"2026-10-28T17:34:10+00:00","fetched_at":"2026-10-28T17:34:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}