CVE detail
CVE-2026-16473
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single byte of adjacent heap memory.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 13.9 · diversity 15.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 3
- within the 30d window
- Peak daily
- 3
- highest bucket
Evidence
Source links by recency
3 source links · newest first
- https://git.kernel.org/pub/scm/bluetooth/sbc.gitgit.kernel.org
No excerpt available.
Patchgit.kernel.orgJul 22, 2026, 11:16 AM - https://bugzilla.redhat.com/show_bug.cgi?id=2503650bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comJul 22, 2026, 11:16 AM - https://access.redhat.com/security/cve/CVE-2026-16473access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJul 22, 2026, 11:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-13077CVSS 7.1 · High
A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can…
- CVE-2026-64833CVSS 7.1 · High
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a…
- CVE-2026-48029CVSS 7.1 · High
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinat…
- CVE-2026-47254CVSS 6.1 · Medium
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()` in `libheif/sequences/track.cc` stores an out-of-bounds ch…
- CVE-2026-47251CVSS 6.8 · Medium
libheif is a HEIF and AVIF file format decoder and encoder. The fix for CVE-2026-3949 (commit `b97c8b5`, PR #1712) introduced an integer overflow in the very security check it add…
- CVE-2026-10680CVSS 7.6 · High
The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against bu…