Advisories » MGASA-2026-0538

Updated bluez package fixes security vulnerabilities

Publication date: 24 Oct 2026
Modification date: 23 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-75032 , CVE-2026-80185 , CVE-2026-80186 , CVE-2026-85218

Description

Out-of-bounds read in avrcp parse_media_element and parse_media_folder.
(CVE-2026-75032)
Unprivileged-local and adjacent-LE-peer leads to arbitrary code
execution as root. (CVE-2026-80185)
Stack Overflow in name2utf8 causes DoS and potential code execution.
(CVE-2026-80186)
AVRCP ListPlayerAttributes Double Stack Overflow. (CVE-2026-85218)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36192
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IEAQGME7YHJPXMGE233SURK752QRXULJ/
• https://bugzilla.redhat.com/show_bug.cgi?id=2517490
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIJJ3EIYPS7BJQ42GWBIECW4O26LYTXD/
• https://github.com/bluez/bluez/security/advisories/GHSA-7mmr-gwqx-vc34
• https://github.com/bluez/bluez/security/advisories/GHSA-68h6-5qgp-3975
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZ5OXQJBQDRPBE4TGOYAU5OIYE7DBUSF/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAGOUZ5PPAGUWRUYV5FOC2X6E7MYP7C5/
• https://github.com/bluez/bluez/security/advisories/GHSA-m2vx-pw5f-rc8v
• https://ubuntu.com/security/notices/USN-8908-1
• https://www.cve.org/CVERecord?id=CVE-2026-75032
• https://www.cve.org/CVERecord?id=CVE-2026-80185
• https://www.cve.org/CVERecord?id=CVE-2026-80186
• https://www.cve.org/CVERecord?id=CVE-2026-85218

SRPMS

10/core

• bluez-5.87-1.1.mga10