What is CVE-2026-101887?

CVE-2026-101887 is a low-severity vulnerability in Arkq Bluez-Alsa, classified under Divide By Zero. CVSS score: 3.5/10. Published 2026-10-01.

How severe is CVE-2026-101887?

Low severity. CVSS v3 base score is 3.5 out of 10.

Vulnerability in Arkq Bluez-Alsa

CVE-2026-101887

BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.

Published 2026-10-01.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Arkq Bluez-Alsa

Weakness classification (CWE)

CWE-369 — Divide By Zero

References

github.com/arkq/bluez-alsa/commit/1a84465dd860d1be9dcf62339c6273e9e0632dd2 (patch)
www.vulncheck.com/advisories/bluealsa-bluealsad-lc3plus-decoder-division-by-zer… (third-party-advisory)

Frequently asked questions

What is CVE-2026-101887?: CVE-2026-101887 is a low-severity vulnerability in Arkq Bluez-Alsa, classified under Divide By Zero. CVSS score: 3.5/10. Published 2026-10-01.
How severe is CVE-2026-101887?: Low severity. CVSS v3 base score is 3.5 out of 10.