Alpine iLX-F511: Stack-based buffer overflow in vCard parsing allows code execution
Summary
The Alpine iLX-F511 in-car multimedia receiver contains a stack-based buffer overflow in its vCard parsing. Unvalidated user-supplied data is copied into a fixed-length stack buffer. An attacker can execute arbitrary code as root if a user connects the device to a malicious Bluetooth device. No vendor fix was available at publication.
Affected
- Alpine iLX-F511, firmware 7.0.0000 (as listed in the CVE record and ZDI advisory)
- Other firmware versions: Unknown.
Fixed in
Unknown. No vendor fix or advisory found at publication.
Workaround
- Do not connect the unit to unknown or untrusted Bluetooth devices (ZDI's only stated mitigation: restrict interaction with the product).
- Switch off Bluetooth when not needed, pair only company-managed phones and remove unknown pairings (suggested, not vendor guidance).
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV.
- No public exploit found (not verified against GitHub or exploit databases).
Our recommendation
- Identify iLX-F511 units in company vehicles and confirm their firmware version.
- Ask Alpine for a fix date and an advisory.
- Apply the Bluetooth restrictions and brief drivers.
- Monitor the ZDI advisory and NVD for updates and patch as soon as a fix is available.
- Priority: medium for fleet and vehicle operators, low for typical office IT.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI advisory ZDI-26-821 www.zerodayinitiative.com
- CVE record (threatint) cve.threatint.com
- PSIRT threat intelligence psirt.com
- Offseq summary radar.offseq.com
- VulDB entry vuldb.com
- Alpine firmware update (US) support.alpine-usa.com
- Alpine software updates (AU) www.alpine.com.au
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:13.
Original description (NVD)
Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29017.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.