CVE-2021-3588: Bluez

Low severity, CVSS 3.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.

Affected products

• Bluez Bluez: before 5.56 (fixed in 5.56)

Published 2021-06-10. Last modified 2026-06-17.