# BlueZ vulnerabilities patched in Ubuntu LTS releases

> **Key takeaway:** Multiple vulnerabilities in the BlueZ Bluetooth stack, including buffer overflows and memory exposure, have been addressed in Ubuntu LTS versions.

**Published:** 2026-10-08T21:50:08+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/bluez-vulnerabilities-patched-in-ubuntu-lts-releases.html 

## Summary
Ubuntu has released security updates to address five vulnerabilities in the BlueZ Bluetooth stack. These flaws, affecting Ubuntu 20.04, 22.04, 24.04, and 26.04 LTS, could allow attackers to cause denial of service, execute arbitrary code, or leak sensitive information through malformed Bluetooth packets or XML input.

## Vulnerability details
- **CVE-2026-19774**: Incorrect codec capability storage in the A2DP profile can lead to a stack buffer overflow.
- **CVE-2026-75032**: Improper packet length validation allows out-of-bounds memory reading.
- **CVE-2026-80185**: Malformed XML input can cause BlueZ to crash.
- **CVE-2026-80186**: Incorrect parsing of remote names from Extended Inquiry Response data can cause a stack buffer overflow.
- **CVE-2026-85218**: Improper response parsing in the AVRCP profile allows out-of-bounds memory access.

## Why it matters
Since BlueZ is the standard Linux Bluetooth stack, these vulnerabilities affect a wide range of desktop and embedded Linux devices running Ubuntu.