Security readout for executives and security teams
Plain-English summary
This is a Bluetooth stack flaw that can crash or disturb media-browsing behavior in products using BlueKitchen BTstack before 1.8.1. An attacker needs a paired Bluetooth Classic connection, so exposure is limited compared with internet-facing bugs, but embedded devices may be harder to inventory and update.
Executive priority
Treat as a targeted Bluetooth-adjacent risk, not an emergency internet-scale issue. Prioritize asset discovery and firmware/vendor validation, especially for devices exposed to public pairing environments or safety-sensitive operations.
Technical view
BTstack before 1.8.1 has insufficient bounds checks in the AVRCP Browsing Target GET_FOLDER_ITEMS handler. Invalid packet boundary or attribute count handling around attr_id can cause out-of-bounds reads and undefined behavior, with reported low integrity and availability impact.
Likely exposure
Most relevant to embedded, IoT, automotive, audio, or custom devices that include BlueKitchen BTstack with Bluetooth Classic AVRCP browsing enabled. The affected metadata in the bundle is sparse, so teams should verify actual library versions in firmware and SBOMs.
Exploitation context
The bundle does not cite active exploitation, and KEV status is false. The stated attacker position is adjacent Bluetooth range with a paired Bluetooth Classic connection and user interaction, limiting broad opportunistic exploitation.
Researcher notes
Focus review on AVRCP Browsing Target GET_FOLDER_ITEMS parsing, packet boundary validation, attribute count handling, and attr_id bitmap state. Avoid assuming exploitability beyond crash or state corruption without product-specific testing and vendor confirmation.
Mitigation direction
- Upgrade BTstack components to version 1.8.1 or later where applicable.
- Check vendor firmware advisories for products embedding BTstack.
- Disable unused Bluetooth Classic or AVRCP browsing features where feasible.
- Limit pairing to trusted devices and remove stale pairings.
- Prioritize firmware updates for devices in shared or public environments.
Validation and detection
- Inventory products, firmware, and SBOMs for BlueKitchen BTstack usage.
- Confirm whether deployed builds are earlier than BTstack 1.8.1.
- Verify whether AVRCP Browsing Target support is enabled.
- Review vendor release notes and advisories for product-specific fixes.
- Run defensive Bluetooth regression tests in a controlled lab environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-758: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28528 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L2.12.5VulnCheckCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
2.1LowVector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Base CVSS 3.1 score
4.6MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/bluekitchen/btstack/releases/tag/v1.8.1CVE reference, VulnCheck · release-notes, patch
- https://www.vulncheck.com/advisories/bluekitchen-btstack-avrcp-browsing-target-get-folder-items-handler-oob-read-undefined-behaviorCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.