// Workers AI · dad joke modeWhat did PerfektBlue say to its friend? "You're dye-namite

PerfektBlue is the name given to a chain of four security vulnerabilities in BlueSDK, a Bluetooth protocol stack developed by OpenSynergy and used in automotive in-vehicle infotainment (IVI) systems. The vulnerabilities, which have each been assigned a CVE, were discovered and named by researchers at the cybersecurity company PCA Cyber Security (formerly PCAutomotive) and disclosed publicly in July 2025. According to the researchers, the vulnerabilities could be chained into a wireless Bluetooth attack that requires at most one user interaction. At the time of disclosure, vehicles from Mercedes-Benz, Volkswagen, and Škoda were confirmed to have been affected.

Background

BlueSDK is a Bluetooth software development kit and protocol stack that can be integrated into a range of operating systems. It supports both Classic and Low Energy modes, and it implements a large set of Bluetooth profiles. The stack is licensed by the Bluetooth Special Interest Group and is embedded in automotive products. According to OpenSynergy, BlueSDK has shipped in about 350 million cars and is present in more than a billion embedded devices worldwide, including consumer, mobile, industrial, and medical products.

Infotainment vulnerabilities

PerfektBlue consists of four vulnerabilities that, if combined, could potentially let an attacker run arbitrary code after establishing a Bluetooth connection.

• CVE-2024-45434 (Critical Severity): Use-After-Free (a specific kind of memory error) in Audio/Video Remote Control Profile (AVRCP) service.
• CVE-2024-45433 (Medium Severity): Incorrect function termination in Radio Frequency Communication (RFCOMM).
• CVE-2024-45432 (Medium Severity): Function call with incorrect parameter in RFCOMM.
• CVE-2024-45431 (Low Severity): Improper validation of a Logical Link Control and Adaptation Protocol (L2CAP) channel's remote Channel Identifier (CID).

Exploitation

To carry out a PerfektBlue attack, the vulnerabilities are chained together to achieve remote code execution.

An attacker must be within Bluetooth range of the target, with the target accepting pairing. On the devices tested, the vulnerabilities were reachable after pairing, although researchers said that on some implementations, they may be reachable before pairing, depending on the profile security level chosen by the developer or the use of the "Just Works" Secure Simple Pairing mode.

After an attacker compromises the infotainment unit, they could theoretically access the GPS location, the microphone, and stored contact lists. According to researchers, weak network segmentation could theoretically let attackers reach other vehicle systems, though that would hinge on further vulnerabilities and how each vehicle is built.

Researchers demonstrated proof-of-concept exploits on infotainment units from Mercedes (Mercedes-Benz NTG6 head units), Volkswagen (Volkswagen MEB ICAS3 infotainment system used in the ID.4), and Škoda (MIB3 head unit used in the Superb).

Disclosure

PCA Cyber Security reported the vulnerabilities to OpenSynergy in May 2024. OpenSynergy confirmed them and started working on patches in mid-July 2024, with the patches released to customers in September 2024. In March 2025, researchers shared the text of the PerfektBlue advisory website with OpenSynergy for review, and by early June, confirmed that the vulnerabilities were affecting several models from a particular carmaker, which they then notified. Researchers notified OpenSynergy that it was going to publish its advisory in early July 2025. By 23 June, one of the affected carmakers said that it had not received the patch, which had been available since September 2024. The advisory was published on 7 July 2025, with the carmaker unnamed.

Responses

OpenSynergy said it was helping customers but that due to non-disclosure agreements, it could not share which carmakers and models were affected.

Mercedes-Benz, one of the carmakers affected, said that external security researchers had notified it about the OpenSynergy BlueSDK framework in November 2024 and that it had taken the measures needed to mitigate risk.

Volkswagen, which was also affected, said the issue was limited to infotainment functions. According to the carmaker, an attack would only be successful if the vehicle was in pairing mode, the pairing request was actively approved by the driver, and the attacker was within about 5 to 7 meters. Even where an attack succeeded, Volkswagen said, critical vehicle functions would stay out of the attacker's reach. It also said that it was rolling out updates and advising owners to check pairing codes before accepting them.

Mikhail Evdokimov, a senior security researcher at PCA Cyber Security, disputed some of Volkswagen's conditions, saying that on the Volkswagen ID.4 and Škoda Superb, the infotainment system can be activated without the ignition on, and that pairing can be initiated remotely without the user placing the system in pairing mode.

Related research

In separate research, the National Cybersecurity Agency of France (ANSSI) analyzed the same OpenSynergy BlueSDK stack and demonstrated a zero-click remote code execution attack on an unnamed premium vehicle's infotainment unit, exploiting a vulnerability similar to the earlier CVE-2018-20378 and bypassing ASLR and DEP mitigations.