A buffer overflow vulnerability exists in the BlueZ A2DP stack that allows a network-adjacent attacker to execute arbitrary code with root privileges by pairing a malicious Bluetooth device with the target system. This flaw is due to improper validation of user-supplied data length before copying to a fixed-length stack buffer. The vulnerability affects multiple Ubuntu LTS releases and has a CVSS score of 7.1 (medium severity). Official patches are available for affected versions.