Out‑of‑Bounds Read (CVE‑2026‑118608) in Alpine iLX‑F511 Bluetooth Stack Exposes Sensitive Data
What It Is — The Zero Day Initiative disclosed a new vulnerability (CVE‑2026‑118608) in the libanwbtstack.so library of Alpine’s iLX‑F511 Bluetooth audio device. The flaw resides in the prh_rfcomm_cc_process_test function, where insufficient validation of attacker‑controlled data permits an out‑of‑bounds read. An adversary who can pair a malicious Bluetooth device with the iLX‑F511 can extract memory contents, potentially revealing sensitive information and, when chained with other bugs, achieving root‑level code execution. The CVSS base score is 3.5 (AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). No public exploit is known, and Alpine has not yet released a patch; mitigation currently relies on restricting Bluetooth pairing to trusted devices.
Affected Products — Alpine iLX‑F511 Bluetooth audio system.
Why It Matters for Trust & Control Assurance — This issue tests the control objective of secure external interface management (ensuring only authorized devices can interact with Bluetooth services). Verisq’s Access Controls capability helps you capture continuous evidence that such interfaces are governed by policy and monitored for compliance.
Recommended Actions —
- Block or whitelist Bluetooth pairing to only approved devices.
- Accelerate firmware update requests with Alpine and track remediation status.
- Conduct a risk assessment of all Bluetooth‑enabled assets and document the controls governing their use.
- Record the mitigation steps in your audit evidence repository.
Source: Zero Day Initiative Advisory