---
id: "CVE-2026-118610"
kind: "vulnerability"
aliases: ["CVE-2026-118610"]
title: "Alpine iLX-F511 car stereo: Android Auto service lets network attacker run root code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["alpine", "android-auto", "automotive", "embedded", "ilx-f511", "infrastructure"]
not_affected_if: ["android-auto-unused"]
published_at: "2026-10-28T17:18:28+00:00"
first_seen_at: "2026-10-28T17:34:10+00:00"
updated_at: "2026-10-28T17:34:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118610", "first_seen_at": "2026-10-28T17:34:10+00:00"}]
---

# Alpine iLX-F511 car stereo: Android Auto service lets network attacker run root code

The Alpine iLX-F511 head unit's Android Auto service copies user-supplied data into a fixed-size stack buffer without checking its length. A network-adjacent attacker can overflow that buffer and execute arbitrary code as root, without authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the head unit's firmware version in its settings menu against the vendor advisory; the sources do not give a version string
- unknown for any other check

## Fix

- unknown: the sources do not name a fixed firmware version or vendor patch; check Alpine's support site for an update to the iLX-F511 firmware

## Timeline

- 2026-10-28T17:34:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118610

## From the sources

Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Android Auto service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29015.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_