Zero-Day Vulnerability in Alpine iLX-F511 Android Auto Handler Allows Remote Code Execution
A stack-based buffer overflow in Alpine's iLX-F511 Android Auto connection handler, discovered by ZDI, allows for remote code execution by physically present attackers.
The Zero Day Initiative (ZDI) has disclosed a critical vulnerability, tracked as ZDI-26-827, affecting the Alpine iLX-F511 in-car infotainment system. This flaw resides within the device's Android Auto connection handler and permits physically present attackers to achieve remote code execution (RCE) without requiring any form of authentication.
The vulnerability stems from an improper validation of user-supplied data length before it is copied into a fixed-size buffer on the stack. This oversight can be exploited by an attacker to overwrite adjacent memory, leading to the execution of arbitrary code with root privileges on the affected device. The CVSS score assigned to this vulnerability is 6.8, indicating a moderate-to-high severity.
Researchers at Neodyme AG, specifically Konstantin Bücheler, are credited with discovering this vulnerability. The disclosure timeline indicates that ZDI first reported the issue to the vendor on February 5, 2026. The vendor acknowledged the report and requested an extension, with ZDI following up on July 21, 2026, and ultimately notifying the vendor of their intent to publish on October 15, 2026, due to the lack of a timely fix.
This vulnerability presents a significant risk to users of the Alpine iLX-F511, particularly given its integration into vehicle systems where physical access might be more readily available than remote access. The ability for an attacker to gain root-level control over the infotainment system could have serious implications, potentially affecting navigation, communication, and other connected vehicle functions.
As of the advisory's publication on October 28, 2026, the only recommended mitigation strategy is to restrict physical interaction with the product. This highlights the severity of the flaw, as no software patch is immediately available, and users are advised to be cautious about connecting their devices to potentially untrusted sources or allowing unauthorized individuals near their vehicle's console.
The coordinated public release of this advisory serves as a warning to consumers and automotive security professionals about the risks associated with connected car technology. It underscores the importance of timely patching and vendor responsiveness to security vulnerabilities, especially those that could compromise critical vehicle functions.
This advisory provides further technical details on the vulnerability, including the specific flaw within the Android Auto service that results from improper validation of user-supplied data length before copying it to a stack-based buffer. It also notes that the vulnerability was demonstrated at the Pwn2Own competition and was reported to the vendor on February 4, 2026, with coordinated public release on October 28, 2026.
This new advisory, ZDI-26-829, details a separate heap-based buffer overflow vulnerability in the Alpine iLX-F511's Bluetooth OBEX packet handling, distinct from the previously reported Android Auto handler flaw. While both vulnerabilities allow for remote code execution by physically present attackers, this new flaw, CVE-2026-118611, requires no authentication and was demonstrated at Pwn2Own, whereas the prior vulnerability was a stack-based overflow.
This new advisory from Zero Day Initiative details a local privilege escalation vulnerability (ZDI-26-820) within the Fiv service of the Alpine iLX-F511 infotainment system. Unlike the previously reported remote code execution flaw, this vulnerability requires an attacker to first gain low-privileged code execution on the device before they can escalate to root privileges. The vulnerability stems from an exposed dangerous method within the Fiv service, allowing for arbitrary code execution in the context of root.
This advisory, ZDI-26-822, details a separate stack-based buffer overflow vulnerability within the Framework Service of the Alpine iLX-F511, distinct from the previously reported SSH vulnerability. While also allowing for remote code execution, this new flaw requires physical presence to exploit and does not need authentication, as demonstrated at the Pwn2Own competition.
This advisory, ZDI-26-823, details a specific stack-based buffer overflow vulnerability within the prh_sdp_service_search_decode function of Alpine iLX-F511 devices. Unlike the previously reported Android Auto handler vulnerability, this new flaw is exploitable by pairing a malicious Bluetooth device, allowing for remote code execution in the context of root. The vulnerability has a CVSS rating of 8.0 and was reported to the vendor on February 4, 2026, with public disclosure occurring on October 28, 2026.