Alpine iLX-F511: Stack-based buffer overflow in Bluetooth SDP handling
Summary
The Alpine iLX-F511, an in-car multimedia receiver (head unit), contains a stack-based buffer overflow in the prh_sdp_service_search_decode function. The input length is not validated before data is copied to a stack buffer. After an attacker gets the ability to pair a malicious Bluetooth device with the unit and the user interacts with it, the attacker can execute arbitrary code as root.
Affected
- Alpine iLX-F511, version 7.0.000 (according to VulDB, not confirmed by the vendor)
- Other versions: Unknown.
Fixed in
Unknown.
Workaround
- ZDI states the only salient mitigation is to restrict interaction with the product.
- Turn off Bluetooth when it is not needed.
- Remove unused paired devices and avoid pairing with unknown devices.
Exploitation
- No public exploit is noted in the ZDI advisory; it was published as a 0-day.
- Not listed as known to be exploited; not in CISA KEV.
- No public proof of concept confirmed in the sources checked.
Our recommendation
- Check whether the company operates vehicles with this head unit (fleet, delivery or service cars).
- Restrict Bluetooth pairing on these units and remove unknown or unused paired devices.
- Turn off Bluetooth if hands-free use is not needed.
- Check Alpine's support site for a firmware update for the iLX-F511 and apply it when available.
- Monitor for vendor advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI-26-823 Advisory www.zerodayinitiative.com
- VulDB CVE-2026-118605 entry vuldb.com
- Strix CVE-2026-118605 www.strix.ai
- Offseq ZDI-26-823 radar radar.offseq.com
- Alpine iLX-F511 product page www.alpine-usa.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:13.
Original description (NVD)
Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the prh_sdp_service_search_decode function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29069.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.