CVE-2026-79377 Details

A heap overflow vulnerability has been identified in the Bestechnic BES2300 Bluetooth Audio SoC firmware versions through 3.x. This vulnerability resides in the L2CAP layer, where the absence of proper bounds checking allows attackers to cause a denial-of-service by sending crafted L2CAP packets. The vulnerability can be exploited by transmitting a sequence of CONTINUE fragments that exceed the allocated buffer size, leading to memory corruption and potential remote code execution.

Users are advised to upgrade to version 5.0 / RC06 or later, as this version addresses the vulnerability by implementing proper bounds checks and reassembly buffer management. For those unable to upgrade immediately, a reference patch is available to add the necessary bounds checking before processing L2CAP packets.