An off-by-one error in the SBC frame decoder of the sbc library in Red Hat Enterprise Linux 10 leads to a one-byte heap out-of-bounds read. This vulnerability can be triggered by a crafted audio payload streamed over Bluetooth, potentially allowing an adjacent attacker to read one byte of adjacent heap memory. The flaw affects the handling of SBC frames in the Bluetooth audio codec stack. The CVSS 3.1 base score is 4.3, reflecting low impact on confidentiality and no impact on integrity or availability. No vendor advisory indicates an available patch or fix yet.

An attacker in Bluetooth proximity streaming audio could exploit this vulnerability to read a single byte of adjacent heap memory. The impact is limited to a minor confidentiality breach with no integrity or availability impact. There are no known exploits in the wild. The flaw does not allow code execution or denial of service based on the current information.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16473 for current remediation guidance. Until a fix is available, consider limiting Bluetooth audio streaming from untrusted devices to reduce exposure.