{"id":"ASB-A-455566331", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-28627", "A-455566331"], "details":"In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"205822490183520084071808805550573095980", "length":6807}, "id":"ASB-A-455566331-22f85846", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_encrypt_change"}}, {"deprecated":false, "digest":{"line_hashes":["266911383651849706627189516025474655044", "22746015159294279785369247517525573417", "16822600875316432780509451369327459240", "69506406385031247304147542052227090042", "234778014219492089925774012715693957129"], "threshold":0.9}, "id":"ASB-A-455566331-3d315cb2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"246751366734274379694686193180412433198", "length":6571}, "id":"ASB-A-455566331-ca99018e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_encrypt_change"}}, {"deprecated":false, "digest":{"line_hashes":["256691374848977035078864017690569886985", "179598493196210115821858848815657945457", "195880702532091725239692041728703023238", "229929706873943957283950205701308384880"], "threshold":0.9}, "id":"ASB-A-455566331-e58bc75c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d", "target":{"file":"system/stack/btm/btm_sec.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["48621335918798919918337838781628094397", "315922361224175920817306337553823066528", "58505352865503788653323961472191447681", "241788827861155263427171009912068500749", "5083288000807364608694487327912323228", "231136603987698915759560593421910865940"], "threshold":0.9}, "id":"ASB-A-455566331-b0a3f646", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e", "target":{"file":"system/stack/btm/btm_sec_utils.cc"}}, {"deprecated":false, "digest":{"function_hash":"311209934801716296561149952539486379434", "length":6070}, "id":"ASB-A-455566331-d298bb19", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_encrypt_change"}}, {"deprecated":false, "digest":{"line_hashes":["73604516503037035217799911193538492959", "13432903150882513040862906307534883967", "113106014658141633640494704114389900491", "94887924795509970787836457779110026018"], "threshold":0.9}, "id":"ASB-A-455566331-e8cc0977", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"196905764144984863732894774175353669607", "length":732}, "id":"ASB-A-455566331-fc2ca36b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e", "target":{"file":"system/stack/btm/btm_sec_utils.cc", "function":"btm_sec_is_enc_algo_downgrade"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45"], "severity":"High", "spl":"2026-09-01", "types":["ID"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"246751366734274379694686193180412433198", "length":6571}, "id":"ASB-A-455566331-9fe2bdfa", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_encrypt_change"}}, {"deprecated":false, "digest":{"line_hashes":["256691374848977035078864017690569886985", "179598493196210115821858848815657945457", "195880702532091725239692041728703023238", "229929706873943957283950205701308384880"], "threshold":0.9}, "id":"ASB-A-455566331-f5d9d990", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45", "target":{"file":"system/stack/btm/btm_sec.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}