CVE-2022-39176: Bluez

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.

Affected products

• Bluez Bluez: before 5.59 (fixed in 5.59)
• Canonical Ubuntu Linux: version 18.04 only; version 20.04 only
• Debian Debian Linux: version 10.0 only

Published 2022-09-02. Last modified 2026-06-17.