{"affected":[{"defaultStatus":"unknown","product":"iLX-F511","source":"CNA: zdi","vendor":"Alpine","versions":[{"status":"affected","version":"7.0.0000"}]}],"cveId":"CVE-2026-118603","cwes":["CWE-121"],"description":"Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.\n\nThe specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29017.","epss":{"date":"2026-11-05","percentile":0.14857,"score":0.00237},"exploits":[],"kev":null,"metrics":[{"score":8,"severity":"high","source":"CNA: zdi","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"}],"modifiedAt":1793899415751,"publishedAt":1793206207173,"references":[{"source":"CNA: zdi","tags":["x_research-advisory"],"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-821/"}],"remediation":[],"revision":"7301cac883bfd46999003357cbb92d990d0baef48c7e20ac6e7c2eab8a07b9e3","sources":[{"modifiedAt":1793899415751,"name":"CNA: zdi","retrievedAt":1793902187949,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118603"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793902198428,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118603"}],"ssvc":{"assessedAt":1793899404385,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability","updatedAt":1793902198428}