(0Day) Alpine iLX‑F511 prh_sdp_service_search_decode Stack‑based Buffer Overflow (CVE‑2026‑118605) – Remote Code Execution
What It Is — Zero‑Day Advisory (ZDI‑26‑823) reports a stack‑based buffer overflow in the prh_sdp_service_search_decode function of Alpine’s iLX‑F511 Bluetooth‑enabled device. An attacker who can pair a malicious Bluetooth device with the target can supply crafted data that overruns the stack buffer, allowing execution of arbitrary code with root privileges. The CVSS 8.0 score (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) classifies the flaw as high‑severity. The vendor has not yet released a fix; mitigation guidance is limited to restricting Bluetooth interactions.
Affected Products — Alpine iLX‑F511 (all firmware versions disclosed).
Why It Matters for Trust & Control Assurance — The vulnerability tests the control objective of secure configuration and vulnerability management—a single control that underpins many frameworks (e.g., NIST CSF 2.0). Continuous evidence of patch status and device hardening is essential to demonstrate a defensible posture.
Recommended Actions
- Block or tightly control Bluetooth pairing on iLX‑F511 units until a vendor patch is available.
- Update asset inventories to flag the device as “unpatched” and feed this status into continuous monitoring tools.
- Monitor Bluetooth traffic for anomalous pairing attempts and log any exploitation indicators.
- Engage Alpine for a timeline on firmware remediation and request proof of remediation testing.