Alpine iLX-F511: Stack-based buffer overflow in Android Auto service allows code execution
Summary
The Android Auto service of the Alpine iLX-F511 car head unit contains a stack-based buffer overflow caused by missing length validation of user-supplied data. A network-adjacent attacker can exploit it without authentication to execute arbitrary code with root privileges on the device. The CNA scores the issue at CVSS 8.8, and NVD analysis was still pending at the time of writing.
Affected
- Alpine iLX-F511, firmware 7.0.000 (only version listed by the sources)
- Other versions: Unknown.
Fixed in
- Unknown. No fixed version is listed in the sources and no vendor advisory was found.
Workaround
- The only mitigation named by ZDI is to restrict interaction with the product. No specific steps are confirmed.
- Limit wireless pairing and connections to trusted phones only.
- Do not confuse with CVE-2026-118609 (ZDI-26-827, physical access).
Exploitation
- Exploited in the wild: No evidence found (OffSeq: not known to be exploited).
- Public PoC or exploit module: None found in the sources as of 26 Oct 2026.
- Exploit market: VulDB estimates USD 0-5k (estimate only).
Our recommendation
- Inventory all iLX-F511 units and record their firmware versions.
- Ask Alpine or the installer for a written patch statement and a fixed firmware version.
- Restrict wireless pairing and Android Auto connections to trusted devices.
- Monitor the ZDI advisory, NVD and Alpine support pages for updates and install fixes promptly once available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI-26-828 Advisory www.zerodayinitiative.com
- VulDB CVE-2026-118610 vuldb.com
- OffSeq: ZDI-26-828 mirror radar.offseq.com
- OffSeq: CVE-2026-118610 exploitation status radar.offseq.com
- Strix: CVE-2026-118610 www.strix.ai
- Alpine Australia software updates (iLX-F511A family) www.alpine.com.au
- Device.report: Alpine iLX-F511 software installation and update manual device.report
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:26.
Original description (NVD)
Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Android Auto service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29015.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.