What is the new PerfektBlue Bluetooth vulnerability affecting vehicles globally in 2026?

Key takeaways

• PerfektBlue chains four flaws in OpenSynergy's BlueSDK, so one device pairing can lead to code execution on the car's infotainment unit.
• The attacker needs to be within Bluetooth range and the user usually has to accept a pairing prompt.
• Turn Bluetooth off when unused and install vehicle software updates when the maker releases them.

The automotive industry faces a new high-risk cybersecurity threat, first reported in July 2025. A sophisticated attack chain named PerfektBlue has been uncovered, exploiting critical vulnerabilities in OpenSynergy’s BlueSDK Bluetooth framework. Here is a structured breakdown of what’s happening, which vehicles are affected, and what organizations and individuals should do next, written in the Google AI Overview format.

What Is PerfektBlue Attack?

PerfektBlue is a Bluetooth-based Remote Code Execution (RCE) exploit chain targeting automotive infotainment systems. It uses four chained vulnerabilities in BlueSDK, a widely used Bluetooth protocol stack, allowing attackers to gain unauthorized control over in-vehicle systems.

• First reported: July 2025

• Primary target: Mercedes-Benz, Volkswagen, Škoda vehicles

• Affected systems: Infotainment systems (IVI), with possible lateral movement to vehicle ECUs

How PerfektBlue Works: Technical Overview

PerfektBlue combines memory corruption and logical vulnerabilities in Bluetooth stack protocols:

• AVRCP (Audio/Video Remote Control Profile)

• L2CAP (Logical Link Control and Adaptation Protocol)

• RFCOMM (Radio Frequency Communication)

The attack requires establishing a Bluetooth connection and possibly a pairing process. Once connected, attackers can remotely exploit these vulnerabilities without user awareness, often requiring just a single click from the victim.

Vulnerabilities in Detail (With CVE IDs and CVSS Scores)

Which Confirmed Vehicle Models Are Affected?

• Mercedes-Benz NTG6/NTG7 head units

• Volkswagen MEB ICAS3 (ID.4 model line)

• Škoda MIB3 head units (Superb model line)

Attackers can potentially access:

• GPS data

• Audio recordings

• Personal user data

• Vehicle control interfaces (ECU lateral movement risk)

Real-World Impact: Why This Matters

Even though OpenSynergy released fixes in September 2024, supply chain complexities delayed patches until as late as June 2025 for some manufacturers. This lag exposes millions of vehicles worldwide to remote hacking risks.

Notably:

• Infotainment systems often hold personal information like contact lists and navigation history.

• If attackers move laterally, they may reach more sensitive vehicle systems beyond infotainment.

Exploit Chain Breakdown: Step-by-Step

1. Initial Bluetooth Connection: Attacker pairs with the target system.

2. RFCOMM Exploitation: Manipulation of protocol termination and function parameters.

3. L2CAP Exploitation: Bypassing security checks with incorrect channel identifiers.

4. AVRCP Use-After-Free: Final stage where attackers gain remote code execution privileges.

The attack chain uses minimal user interaction and doesn’t require authentication or prior system compromise.

What Are the Mitigation Strategies for Organizations and Users?

Firmware Updates

• Patch immediately using vendor-released updates:

  • SQL Server 2022 → KB 5058721

  • SQL Server 2019 → KB 5058722

  • SQL Server 2017 → KB 5058714
    (For infotainment systems, check manufacturer-specific updates.)

Disable Bluetooth if Not Essential

• Especially in high-risk environments (government, corporate fleets).

Network Segmentation

• Ensure that IVI systems are isolated from mission-critical vehicle control networks.

Manufacturer Actions

• Prioritize vulnerability scanning in Bluetooth stack implementations.

• Strengthen vulnerability disclosure processes with supply chain partners.

Lessons for Automotive Cybersecurity in 2026

• Supply chain patch delays remain a critical weak link in automotive security.

• Infotainment systems now represent a real attack surface with privacy and safety risks.

• Manufacturers must enforce zero-trust principles even within vehicle architectures.

PerfektBlue Key Facts

Conclusion

PerfektBlue underlines how even non-critical vehicle systems can pose significant cybersecurity risks. Bluetooth stacks, long considered low-priority, are now frontline targets for attackers.

For automotive companies, proactive threat modeling, rapid patching workflows, and security validation at every layer of development are non-negotiable in today’s cyber environment.

Related reading

• Tesla Wall Connector Charger Hacked | Through Charging Port in 18-Minute Attack
• CVE-2025-49719 SQL Server Vulnerability Explained | Patch Guide & Security Risks
• Bluetooth Flaws Could Let Hackers Spy Through Your Microphone | Vulnerabilities in Airoha Chips Explained

Reference

For the authoritative details, see National Vulnerability Database.