CVE-2026-118609 ‒ Alpine iLX-F511 Android Auto Connection Handler Remote Code Execution Vulnerability (Pwn2Own)
Authored by:
Metrics: cve.org
Description
This vulnerability allows physically present unauthenticated attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices.
Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Android Auto connection handler. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
Mitigations
Currently, the only salient mitigation strategy is to restrict interaction with the product.
Timeline
| Date | Action |
|---|---|
| 22.01.2026 | Vulnerability demonstrated and disclosed to ZDI at Pwn2Own Automotive |
| 05.02.2026 | ZDI reported the vulnerability to the vendor |
| 07.06.2026 | Vendor acknowledged the receipt of the report and asked for an extension |
| 21.07.2026 | ZDI requested an update on the status of the fix |
| 15.10.2026 | ZDI notified the vendor of the intention to publish the case as a 0-day advisory |
| 28.10.2026 | Coordinated public release of advisory |
References
Share: