BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-39176.json"