Bluetooth vulnerabilities and fixes

CVEs that mention Bluetooth, ranked by priority. 33 tracked.

Bluetooth has 33 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 18. Most recent: 2026-10-23. Highest priority: CVE-2026-45813 (score 47/100).

• CVE-2026-45813 HIGH 8.8 UPGRADE Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Impro
• CVE-2026-45811 HIGH 7.5 UPGRADE Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI
• CVE-2026-74534 HIGH 8.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_co
• CVE-2026-79982 HIGH 8.8 The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copi
• CVE-2026-19291 HIGH 8.8 Bluetooth re-pairing with an existing device can use a lower security level
• CVE-2023-7356 HIGH 8.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data
• CVE-2026-10685 HIGH 7.6 UPGRADE The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt
• CVE-2026-11368 HIGH 7.1 UPGRADE The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its ow
• CVE-2026-99012 HIGH 7.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent conn
• CVE-2026-99013 HIGH 7.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS lis
• CVE-2026-99014 HIGH 7.8 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb life
• CVE-2026-99011 HIGH 7.1 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco_conn lifeti
• CVE-2026-65935 HIGH 7.6 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the tempo
• CVE-2026-98456 HIGH 7.0 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read_unconf_
• CVE-2026-2411 MEDIUM 6.5 UPGRADE Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declara
• CVE-2026-17986 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-20495 HIGH 7.8 MITIGATE MITIGATE In Bluetooth driver, there is a possible permission bypass due to a missing permission check
• CVE-2026-11893 MEDIUM 5.9 The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drive
• CVE-2026-11894 MEDIUM 5.9 The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, vi
• CVE-2026-12236 MEDIUM 6.5 The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an A
• CVE-2026-17906 MEDIUM 5.8 UPGRADE Insufficient validation of untrusted input in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remo
• CVE-2026-65933 MEDIUM 5.3 A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information
• CVE-2026-65936 MEDIUM 5.3 A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive i
• CVE-2026-17737 MEDIUM 5.0 UPGRADE Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who h
• CVE-2026-30613 MEDIUM 4.6 An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi/Bluetooth Enabled So
• CVE-2026-10774 LOW 2.4 UPGRADE Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown
• CVE-2026-63243 MEDIUM 4.3 An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Kat
• CVE-2026-78117 MEDIUM 4.2 The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing H
• CVE-2026-18748 LOW 3.5 The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte
• CVE-2026-99008 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev deref
• CVE-2026-99009 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session so
• CVE-2026-99010 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the
• CVE-2026-99015 HIGH n/a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Serialize dead-devic

FAQ

How do I fix Bluetooth vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Bluetooth being exploited right now?

None of the tracked Bluetooth CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Bluetooth CVE should I patch first?

CVE-2026-45813 currently ranks highest (47/100): Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Impro.

← Back to latest CVEs