CVE-2026-101887

Katalog CVE

CVSS 3.5 · Low EPSS 0,15%

Kerentanan Divide By Zero. Skor CVSS 3.1 3.5 (Low) menurut vulncheck.com.

Deskripsi (NVD)

BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.

Rincian

Terbit di NVD

1 Oktober 2026

Terakhir diubah

1 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

3.5 (Low), sumber vulncheck.com
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-369: Divide By Zero

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/arkq/bluez-alsa/commit/1a84465dd860d1be9dcf62339c6273e9e0632dd2
• https://www.vulncheck.com/advisories/bluealsa-bluealsad-lc3plus-decoder-division-by-zero-dos