CVE-2023-50229 is a High severity (CVSS 8.0 in the record) heap based buffer overflow in BlueZ, the Linux Bluetooth stack. It is in handling of the Phone Book Access profile and can lead to code execution as root when a user connects to a malicious device. Install a patched bluez package.
What's affected
Product: BlueZ. The record lists the product with no version range. The upstream fix is the commit titled "pbap: Fix not checking Primary/Secundary Counter length", linked in the sources. A Debian LTS announcement from September 2024 is also referenced, which suggests distribution backports, though that page would not load for me.
Severity differs between sources. The NVD record scores this 8.0 (High), while ZDI advisory ZDI-23-1811 scores it 7.1 with vector AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Both describe a network adjacent attacker, meaning a device within Bluetooth range, and both say user interaction is required: the target must connect to a malicious Bluetooth device. Both ratings are High.
This is the first of two BlueZ Phone Book Access findings reported together. The other is CVE-2023-50230, and both point at the same upstream commit.
How to check if you're exposed
Find the BlueZ version your system runs, and which package supplies it.
bluetoothd --version
dpkg -l bluez # Debian and Ubuntu
rpm -q bluez # RHEL, Fedora, SUSE
The bug is in the OBEX client code that handles the Phone Book Access Profile, so also check whether the obex service is installed and enabled on the machine. Laptops and embedded Linux devices with Bluetooth often have it present by default, while headless servers usually do not run Bluetooth at all.
Then compare your package version against your distribution's security tracker. I could not confirm a fixed upstream release number from the pages I fetched, so rely on the distribution advisory for the exact patched package.
What to do now
- Install the updated bluez package from your distribution and restart the Bluetooth and obex services, or reboot.
- If the machine does not need Bluetooth, disable the service or remove the package. Less code running means less exposure.
- On shared or kiosk devices, turn off automatic pairing and remove paired devices that nobody recognizes.
- Rebuild any container or appliance images that bundle BlueZ, since the base layer carries the old library until you do.
- Add bluez to your SBOM review so future advisories match.
Why it matters
The weakness is CWE-122, a heap based buffer overflow. ZDI describes it as a lack of validation of the length of user supplied data before copying it into a fixed length heap buffer. The fix commit message adds useful detail: the Primary and Secondary Counters in the phone book response are supposed to be 16 byte values, and if the remote server implements them incorrectly, the client crashes. The commit message includes a sanitizer report of a heap buffer over-read in the version reading function of the OBEX client.
In plain terms, the client trusted a length field sent by the other device. A phone, car kit or anything else that speaks the profile is a remote party, and it should be treated as untrusted input. A malicious one could send a counter of the wrong size.
The record puts the execution context at root, which is why the score is high even though the attacker must be nearby and the user must connect. KEV is false for this CVE. The gold.safeguard.sh/scan page can check the open source packages in a repository, and the Gold directory lists this CVE with its CWE.
Try it yourself
If BlueZ ships inside a container or appliance image, a scan of the image layers is how you find it. The demo below walks through one.
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker have to be on my network?
No, but they must be in Bluetooth range. The advisory calls this network adjacent and says the user must connect to the malicious device.
Which BlueZ release fixes it?
I could not confirm one. The upstream fix is a single commit, and distributions backport it. Check your distribution advisory for the patched package version.
Sources
Last reviewed: 19 October 2026.
