A vulnerability was found in BlueKitchen BTstack up to 1.8.0. It has been classified as problematic. This affects the function
GET_PLAYER_APPLICATION_SETTING_ATTRIBUTE_TEXT/GET_PLAYER_APPLICATION_SETTING_VALUE_TEXT of the component AVRCP Controller. The manipulation leads to out-of-bounds read.
This vulnerability is documented as CVE-2026-28527. The attack requires being on the local network. There is not any exploit available.
Upgrading the affected component is recommended.
