Bluetooth “Heartbleed” and DoS Flaws Found in Xiaomi Redmi Buds, No Patch

A pair of critical vulnerabilities has been discovered in Xiaomi’s Redmi Buds series, exposing users to privacy leaks and persistent denial-of-service attacks. According to CERT/CC, the flaws affect Redmi Buds 3 Pro through 6 Pro, allowing attackers within Bluetooth range to crash devices or steal sensitive call data without pairing or authenticating.

The more severe CVE-2025-13834 is described as an information leak, with researchers comparing it to Heartbleed and noting that an attacker can steal up to 127 bytes of data with a single crafted packet. A second flaw, CVE-2025-13328, targets availability by flooding the buds’ control channels, which can exhaust resources and force the firmware to crash, requiring a physical reset to recover.

There is currently no official patch available, and the article advises users to minimise exposure by disabling Bluetooth when the earbuds are not in use, particularly in public or shared environments.