CVE-2026-101887

LowCVSS 3.5/10Last modified Oct 1, 2026

Description

BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-369

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
arkq	bluez-alsa	< 1a84465dd860d1be9dcf62339c6273e9e0632dd2

References

Timeline

Published: Oct 1, 2026
Last modified: Oct 1, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1018887.2The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators CVE-2026-1018896.5The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete CVE-2026-101898.8A vulnerability has been found in Tenda W12 3.0.0.7(4763). This vulnerability affects the function cgiSysTimeInfoSet of the file /bin/httpd.CVE-2026-1018905.4The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbi CVE-2026-1018919.3An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with netw CVE-2026-1018934.4Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatical CVE-2026-1018949.1The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexica CVE-2026-1018958.7Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to CVE-2026-1018968.2Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to CVE-2026-1018975.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.2 CVE-2026-1018987.0Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently CVE-2026-1018996.9Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR