CVE-2023-44431 is a high severity stack-based buffer overflow in the AVRCP audio profile code of BlueZ, the Linux Bluetooth stack. NVD scores it 8.0 and ZDI scores it 7.1. The sources name no fixed release, so check your distribution for a BlueZ update and avoid pairing with unknown devices meanwhile.
What's affected
The NVD record lists BlueZ 5.66 as the affected version. The Zero Day Initiative advisory ZDI-23-1900 (ZDI-CAN-19909), published on 21 December 2023, names BlueZ without a version range. Neither source names a fixed version.
The two sources disagree on severity. NVD scores the flaw 8.0 with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. ZDI scores it 7.1 with the vector AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, which differs only in attack complexity (High rather than Low). Both are High severity, and both are reported here.
The attack is network-adjacent, which for Bluetooth means within radio range. User interaction is required: the advisory says the target must connect to a malicious device. The code runs as root, according to the advisory.
The ZDI page says the issue was reported to the vendor on 13 April 2023 and published as a zero-day advisory on 21 December 2023. Its mitigation note says the only salient strategy is to restrict interaction with the application. A distribution may have backported a fix since, so look at your vendor notices.
Weakness class: CWE-121 (stack-based buffer overflow).
How to check if you're exposed
On a Linux host, read the BlueZ version:
bluetoothd --version
Then see whether the Bluetooth service is running at all:
systemctl status bluetooth
If the service is inactive and disabled, the exposure is low. If it is active, compare your package with your distribution's security tracker for CVE-2023-44431, since version numbers alone can mislead when fixes are backported. On servers and fleet machines that never use Bluetooth, check that the service is disabled.
What to do now
- Find Linux systems that run bluetoothd: laptops, kiosks, embedded Linux devices and any server with a Bluetooth adapter.
- Look in your distribution security tracker for a BlueZ update that references CVE-2023-44431 and install it.
- Disable the bluetooth service on systems that have no need for it.
- Tell users not to pair with or connect to unknown audio devices on affected machines, because the attack needs a connection to a malicious device.
- If a vendor device ships BlueZ in its firmware, ask the vendor for its status, since you cannot patch that yourself.
Why it matters
The AVRCP profile lets Bluetooth devices send media control commands. The advisory says BlueZ copies user-supplied data into a fixed-length stack buffer without checking its length. That is the textbook stack overflow, tracked as CWE-121. On the stack, an overwrite can reach return addresses and other control data, which is why code execution is the worst case.
Bluetooth bugs have a different risk shape from web bugs. The attacker must be close by and the user must connect, so mass exploitation is harder. But the process runs as root, so a successful attack is not contained. CVE-2023-44431 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
This is a system component, so Safeguard's free in-browser dependency scan will not show it. Track it through your operating system patching and asset inventory, and use the scan for the application dependencies your teams ship.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which BlueZ version is fixed for CVE-2023-44431?
Neither the NVD record nor the ZDI advisory names one. Check your Linux distribution's security tracker for the package version that carries the fix.
Why do NVD and ZDI show different scores?
NVD gives 8.0 and ZDI gives 7.1. The vectors differ in attack complexity. Both rate it High.
Sources
Last reviewed: 19 October 2026.
