The vulnerability in BlueZ affects the Audio/Video Remote Control Profile (AVRCP) implementation, specifically in the parse_media_element() and parse_media_folder() functions. Insufficient validation of packet length fields in GetFolderItems responses allows a malicious Bluetooth device within radio range to trigger an out-of-bounds read. This can lead to a crash of the bluetoothd daemon, resulting in denial of service, and may expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device. Red Hat ships BlueZ in Red Hat Enterprise Linux 10 and related products. The vulnerability has a CVSS v3.1 score of 6.3 (medium severity) with attack vector adjacent network, low attack complexity, no privileges required, user interaction required, and impacts confidentiality (low) and availability (high). No official fix or patch has been confirmed yet according to the vendor advisory. Recommended mitigations include disabling the AVRCP Bluetooth profile if not needed or restricting pairing to trusted devices, or disabling Bluetooth entirely if unused.

Successful exploitation can cause the bluetoothd daemon to crash, resulting in denial of service. Additionally, limited sensitive heap memory contents could be exposed, potentially leaking information such as cryptographic keys or memory addresses. The vulnerability requires a malicious Bluetooth device within radio range and user interaction to pair with that device. There is no indication of integrity impact or remote code execution from the provided data.

No official patch or fix is currently confirmed. Mitigation involves disabling the AVRCP Bluetooth profile if it is not needed or restricting Bluetooth pairing to trusted devices only. If Bluetooth is not required on the system, disabling the Bluetooth subsystem entirely is recommended. Monitor the Red Hat advisory for updates on patch availability.