# CVE-2019-8922: bluez: A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48

CVE-2019-8922 is fixed in 7 products on 1 platform, first by bluetooth 5.48-0ubuntu3.7, released November 29, 2021. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2019-8922
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0153
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 29, 2021

## Description

A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buffer. The function simply appends all data passed to it. The values of all attributes that are requested are appended to the output buffer. There are no size checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by process_request (in sdpd-request.c), which also allocates the response buffer.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | bluetooth Ubuntu 18.04.6 LTS (bionic) | 5.48-0ubuntu3.7 | [bluetooth 5.48-0ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-bluetooth-5.48-0ubuntu3.7.md) | Nov 29, 2021 |
| Linux | bluez Debian 12.15 (bookworm) | 5.54-1 | [DEBIAN-CVE-2019-8922](https://patchblox.com/security/data/fix/linux/debian-cve-2019-8922.md) | Nov 29, 2021 |
| Linux | bluez Debian 13.5 (trixie) | 5.54-1 | [DEBIAN-CVE-2019-8922](https://patchblox.com/security/data/fix/linux/debian-cve-2019-8922.md) | Nov 29, 2021 |
| Linux | bluez Debian 14 | 5.54-1 | [DEBIAN-CVE-2019-8922](https://patchblox.com/security/data/fix/linux/debian-cve-2019-8922.md) | Nov 29, 2021 |
| Linux | bluez Ubuntu 18.04.6 LTS (bionic) | 5.48-0ubuntu3.7 | [bluez 5.48-0ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-bluez-5.48-0ubuntu3.7.md) | Nov 29, 2021 |
| Linux | bluez-cups Ubuntu 18.04.6 LTS (bionic) | 5.48-0ubuntu3.7 | [bluez-cups 5.48-0ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-bluez-cups-5.48-0ubuntu3.7.md) | Nov 29, 2021 |
| Linux | bluez-hcidump Ubuntu 18.04.6 LTS (bionic) | 5.48-0ubuntu3.7 | [bluez-hcidump 5.48-0ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-bluez-hcidump-5.48-0ubuntu3.7.md) | Nov 29, 2021 |
| Linux | bluez-obexd Ubuntu 18.04.6 LTS (bionic) | 5.48-0ubuntu3.7 | [bluez-obexd 5.48-0ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-bluez-obexd-5.48-0ubuntu3.7.md) | Nov 29, 2021 |
| Linux | bluez-tests Ubuntu 18.04.6 LTS (bionic) | 5.48-0ubuntu3.7 | [bluez-tests 5.48-0ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-bluez-tests-5.48-0ubuntu3.7.md) | Nov 29, 2021 |
| Linux | libbluetooth3 Ubuntu 18.04.6 LTS (bionic) | 5.48-0ubuntu3.7 | [libbluetooth3 5.48-0ubuntu3.7](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libbluetooth3-5.48-0ubuntu3.7.md) | Nov 29, 2021 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.