Buffer overflow in Bosch Infotainment System Ecu
CVE-2025-32061
The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges. First identified on Nissan Leaf ZE1 manufactured in 2020.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (31.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Bosch Infotainment System Ecu — versions 283C30861E
Weakness classification (CWE)
References
- cve@asrg.io (product)
- cve@asrg.io (media-coverage)
- cve@asrg.io (third-party-advisory)
Frequently asked questions
- What is CVE-2025-32061?
- CVE-2025-32061 is a high-severity vulnerability in Bosch Infotainment System Ecu, classified under Stack-based Buffer Overflow. CVSS score: 8.8/10. Published 2026-02-15.
- How severe is CVE-2025-32061?
- High severity. CVSS v3 base score is 8.8 out of 10.