Hi,

The following vulnerability was published for bluez.

CVE-2026-85218[0]:
| NN-2026-0145: AVRCP ListPlayerAttributes Double Stack Overflow


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-85218
https://www.cve.org/CVERecord?id=CVE-2026-85218
[1] https://github.com/bluez/bluez/security/advisories/GHSA-m2vx-pw5f-rc8v

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
bluez, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146760@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated bluez package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 26 Sep 2026 17:59:43 +0200
Source: bluez
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 5.87-4
Distribution: unstable
Urgency: high
Maintainer: Debian Bluetooth Maintainers <team+pkg-bluetooth@tracker.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1146760
Changes:
 bluez (5.87-4) unstable; urgency=high
 .
   * SECURITY UPDATE
     - debian/patches/CVE-2026-85218:
       ARCP ListPlayerAttributes Double Stack Overflow
       + CVE-2026-85218 (Closes: #1146760)
     - Cherry-pick two other related fixes:
       + all-Fix-typo-in-AVRCP_ATTRIBUTE_ILEGAL.patch
       + avrcp-Fix-out-of-bounds-read-parsing-attribute-lists.patch
Checksums-Sha1:
 d161a8c732c47a9d6ca1766fa051318f04535ed3 2850 bluez_5.87-4.dsc
 586ed129e9cb44c81d66f086f65bdd6881132bde 43408 bluez_5.87-4.debian.tar.xz
 1cc6fce1f9607143bdf563a06b8b81635961bcc2 7981 bluez_5.87-4_source.buildinfo
Checksums-Sha256:
 53f780a1b7711ca0e6577e2e28e4a7210987b0661e80e45327a4f84758d417e7 2850 bluez_5.87-4.dsc
 3510b2b38503a6ae0c88a4ac7adcdfe74b6460d275d4018302b35c164fddbfec 43408 bluez_5.87-4.debian.tar.xz
 0f8ac49fc31251bcbc0d46745a95116b7dc81a6691cc9cd6af67a48de9f910e6 7981 bluez_5.87-4_source.buildinfo
Files:
 857d49e0b80c56e6d6f1182b6e42fb6a 2850 admin optional bluez_5.87-4.dsc
 b45727387c6e6d0aa2d24bbe445c7d94 43408 admin optional bluez_5.87-4.debian.tar.xz
 54938fcc6d7265091b89cfbbbc6f7155 7981 admin optional bluez_5.87-4_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmq37EUACgkQ5mx3Wuv+
bH3WPRAA184FtOc0YbmQPwb9hJi9QeTLuCTFxtKh0Tj1iNwZsDvxvMeWRdtRup1i
8BvdhQohqVDnYVS1yi83psTIBsjlHA1K4C5aabDg3RBCg1hHK5XeQuLY5rB3ZThH
ODFlV6qcOi6qX1plfOo4jERD1yUiae3ILsqClWS37S4QkooJI/fx2/Uw2O+wrB0M
Tvv0Fm08RyywYZH0R+HRDYKTZSNKuPY2PH2yaFK02uCOqpmhTho9dYpJrLDrdLSQ
qdyYsY1fm6bXdkqhrnMroTh++u3OaIkZTNJBAzEExUQTsA95HR9m09Mc77TC/6e1
Pa/Z7McmWHnD0sFQT8af+Yd20Zj6QfhmL5Hcc7C8ZgpcxvI/qDuFNALcGHDOzV8b
7in1ydHkMw/BSfId8pK5NJIXXo1psFkimcDbRp9pxWGPuhHc7iYyNNL01RxiNvup
FUHYHF0KYVwMDwatP4vFwUNCucERbQJXAM7jLL33WO6OjtRjdwBUkI3vhGJ9OlMu
7jpvnRWui841AJgudES4+cZTcT8kJEiJPTLCqwrwHty5QCcHXrd+0JLM9dq0jXan
kOc1QvoNuwIt7Fj2xy3lNxKPgmHYctL9Zf7qEGZSnyiCID2qU1XrwIjdtXBKLO51
5uS1ZyF8S9EO/4cxskmYJwtKjKSFrIawnZwe1LZ7fKXgBmu86Ys=
=ZkUD
-----END PGP SIGNATURE-----