CVE-2026-118611 is a heap-based buffer overflow vulnerability in the Bluetooth OBEX packet handling of Alpine iLX-F511 devices. It allows an attacker with physical proximity to execute arbitrary code with root privileges without requiring authentication. The flaw arises from improper validation of the length of user-supplied data before copying it to a heap buffer.