{"id":"ASB-A-503554165", "published":"2026-09-01T00:00:00Z", "modified":"2026-09-10T15:43:18.983809180Z", "aliases":["CVE-2026-45515", "A-503554165"], "details":"In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-09-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e87caba4b8dfdb826c1d4b7cbb8a192d31ce7e85"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"11724925184125819064344196389817592483", "length":1664}, "id":"ASB-A-503554165-78330327", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e87caba4b8dfdb826c1d4b7cbb8a192d31ce7e85", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc", "function":"a2dp_vendor_opus_decoder_decode_packet"}}, {"deprecated":false, "digest":{"line_hashes":["112373446171663809869640892700044938689", "118917688269711103279799354748860035008", "138058523224533762607675471789792265359", "307630405767951864583931674205263119200", "208155317813887102245563963008989563285", "114811983039094628438859413554804319863", "331807186545735884827352105396800808085", "179784592781943990224755688927913883544", "44794428931293768415444562445896552755", "70752763005570436028786168213805771363", "222965713880767479490121852352129223260", "145688579517188459029427134524127377578", "260349400304330259382744213044346081028", "75739102308686404547069140805224666999", "148149249591933987738877270520379118725", "187326446204122394750906423536920348027", "18023967186741516646884973433092084145", "128994792291507184593194642354422667465", "32087707219056433049869342162387490043", "132982703881331234420883009959454590721", "279170509792850770080381518966249198539", "265586829114751495691861076629484508559", "124742650738242512918519193356679738573", "180880475039105403286396023424403160004", "298623726518687204779881775531827294725", "192836523542020636883385478555009092432", "241024831239543635561609320795578441507", "63023319149774050960125992398873200987", "310568192335556860099790048577565682933"], "threshold":0.9}, "id":"ASB-A-503554165-e581d3bd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e87caba4b8dfdb826c1d4b7cbb8a192d31ce7e85", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-09-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fa95ffbb31eeb9eff4dfa1318a4f503d65b3732b"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["308816780056672039596414764039062193456", "309223892947826543722540600602693433640", "58659191746476790793202899776965703854", "183275681066096025451777261374101096633", "216695161596807557591873795869110715093", "145698361171556500030788192761291644126", "187609231002536059502007748554215019280", "182602075338744585112105718613542638202", "266725900234129417486082614476257090174", "265306512510489736354051698007617828557", "183541731127391317592899031334044255112", "337030324200886748285543608716817982580", "179784592781943990224755688927913883544", "19178213491240358276713708448705011600", "267774788116652082706295939806057543980", "222965713880767479490121852352129223260", "145688579517188459029427134524127377578", "198052604672054376143224198012834977094", "26796940221397657608399312853433149997", "284122508446857831006519722044579584093", "187326446204122394750906423536920348027", "18023967186741516646884973433092084145", "128994792291507184593194642354422667465", "75442546376225858835932859662086938154", "152407064014556496855314086660764890661", "121702905086443873076930903835796365421", "214480308593766222209601660056177199239", "72934979116336358475700849108144069137", "320370179011600833910871077454695159154", "47220801757088905102391092920500596210", "337316653778524130537684207906380524864", "86240491715320185517829365967129243283", "197494463814088336627407800758568112017", "164820060521441480337942670299694831489", "296341781001668297495381803555356229114", "63023319149774050960125992398873200987", "310568192335556860099790048577565682933"], "threshold":0.9}, "id":"ASB-A-503554165-73d8cb03", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fa95ffbb31eeb9eff4dfa1318a4f503d65b3732b", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"}}, {"deprecated":false, "digest":{"function_hash":"11724925184125819064344196389817592483", "length":1664}, "id":"ASB-A-503554165-fdf2485f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fa95ffbb31eeb9eff4dfa1318a4f503d65b3732b", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc", "function":"a2dp_vendor_opus_decoder_decode_packet"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-09-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2854dae19ea705b8a94753baeb9f8f008d3b814c"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"11724925184125819064344196389817592483", "length":1664}, "id":"ASB-A-503554165-bcc411d1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2854dae19ea705b8a94753baeb9f8f008d3b814c", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc", "function":"a2dp_vendor_opus_decoder_decode_packet"}}, {"deprecated":false, "digest":{"line_hashes":["112373446171663809869640892700044938689", "118917688269711103279799354748860035008", "138058523224533762607675471789792265359", "307630405767951864583931674205263119200", "208155317813887102245563963008989563285", "114811983039094628438859413554804319863", "331807186545735884827352105396800808085", "179784592781943990224755688927913883544", "44794428931293768415444562445896552755", "70752763005570436028786168213805771363", "222965713880767479490121852352129223260", "145688579517188459029427134524127377578", "260349400304330259382744213044346081028", "75739102308686404547069140805224666999", "148149249591933987738877270520379118725", "187326446204122394750906423536920348027", "18023967186741516646884973433092084145", "128994792291507184593194642354422667465", "32087707219056433049869342162387490043", "132982703881331234420883009959454590721", "279170509792850770080381518966249198539", "265586829114751495691861076629484508559", "124742650738242512918519193356679738573", "180880475039105403286396023424403160004", "298623726518687204779881775531827294725", "192836523542020636883385478555009092432", "241024831239543635561609320795578441507", "63023319149774050960125992398873200987", "310568192335556860099790048577565682933"], "threshold":0.9}, "id":"ASB-A-503554165-c26d545f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2854dae19ea705b8a94753baeb9f8f008d3b814c", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-09-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/733ed68aad584cfd0dcded036fd5f75f4f853faf"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"11724925184125819064344196389817592483", "length":1664}, "id":"ASB-A-503554165-81f4a7c7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/733ed68aad584cfd0dcded036fd5f75f4f853faf", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc", "function":"a2dp_vendor_opus_decoder_decode_packet"}}, {"deprecated":false, "digest":{"line_hashes":["112373446171663809869640892700044938689", "118917688269711103279799354748860035008", "138058523224533762607675471789792265359", "307630405767951864583931674205263119200", "208155317813887102245563963008989563285", "114811983039094628438859413554804319863", "331807186545735884827352105396800808085", "179784592781943990224755688927913883544", "44794428931293768415444562445896552755", "70752763005570436028786168213805771363", "222965713880767479490121852352129223260", "145688579517188459029427134524127377578", "260349400304330259382744213044346081028", "75739102308686404547069140805224666999", "148149249591933987738877270520379118725", "187326446204122394750906423536920348027", "18023967186741516646884973433092084145", "128994792291507184593194642354422667465", "32087707219056433049869342162387490043", "132982703881331234420883009959454590721", "279170509792850770080381518966249198539", "265586829114751495691861076629484508559", "124742650738242512918519193356679738573", "180880475039105403286396023424403160004", "298623726518687204779881775531827294725", "192836523542020636883385478555009092432", "241024831239543635561609320795578441507", "63023319149774050960125992398873200987", "310568192335556860099790048577565682933"], "threshold":0.9}, "id":"ASB-A-503554165-daf6d808", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/733ed68aad584cfd0dcded036fd5f75f4f853faf", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-09-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/332d58ff7e067e90d1284d0bff4a3c1aad9ddd36"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["112373446171663809869640892700044938689", "118917688269711103279799354748860035008", "138058523224533762607675471789792265359", "307630405767951864583931674205263119200", "208155317813887102245563963008989563285", "114811983039094628438859413554804319863", "331807186545735884827352105396800808085", "179784592781943990224755688927913883544", "44794428931293768415444562445896552755", "70752763005570436028786168213805771363", "222965713880767479490121852352129223260", "145688579517188459029427134524127377578", "260349400304330259382744213044346081028", "75739102308686404547069140805224666999", "148149249591933987738877270520379118725", "187326446204122394750906423536920348027", "18023967186741516646884973433092084145", "128994792291507184593194642354422667465", "32087707219056433049869342162387490043", "132982703881331234420883009959454590721", "279170509792850770080381518966249198539", "265586829114751495691861076629484508559", "124742650738242512918519193356679738573", "180880475039105403286396023424403160004", "298623726518687204779881775531827294725", "192836523542020636883385478555009092432", "241024831239543635561609320795578441507", "63023319149774050960125992398873200987", "310568192335556860099790048577565682933"], "threshold":0.9}, "id":"ASB-A-503554165-f24abe95", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/332d58ff7e067e90d1284d0bff4a3c1aad9ddd36", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"}}, {"deprecated":false, "digest":{"function_hash":"11724925184125819064344196389817592483", "length":1664}, "id":"ASB-A-503554165-f2e55825", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/332d58ff7e067e90d1284d0bff4a3c1aad9ddd36", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc", "function":"a2dp_vendor_opus_decoder_decode_packet"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-09-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b97933907b9230a21c24e3d6c0504bedc0b5d7d0"], "severity":"Critical", "spl":"2026-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"212402463810844531308059378202135754699", "length":1640}, "id":"ASB-A-503554165-2e8cadcf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b97933907b9230a21c24e3d6c0504bedc0b5d7d0", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc", "function":"a2dp_vendor_opus_decoder_decode_packet"}}, {"deprecated":false, "digest":{"line_hashes":["308816780056672039596414764039062193456", "309223892947826543722540600602693433640", "58659191746476790793202899776965703854", "183275681066096025451777261374101096633", "216695161596807557591873795869110715093", "9456355801755336650136578021090603293", "196884114308225482761676448296442713340", "168654695613025805246815026095172185701", "277329114828181365692550183877850336796", "188483142884733522803133433848524686490", "159555971795796961022376608170771154216", "337030324200886748285543608716817982580", "179784592781943990224755688927913883544", "19178213491240358276713708448705011600", "267774788116652082706295939806057543980", "222965713880767479490121852352129223260", "145688579517188459029427134524127377578", "34844861341963283875652484457194954221", "57933610495997720424324877907331194381", "28941166270523148116607490789846068180", "337463211721465115020182532796386083887", "18023967186741516646884973433092084145", "128994792291507184593194642354422667465", "315290418088110752554347083553020671177", "204239261213974384366500298162384042839", "241553056156693339881432564717974428452", "121107427244305916810812779401759248582", "72934979116336358475700849108144069137", "320370179011600833910871077454695159154", "47220801757088905102391092920500596210", "337316653778524130537684207906380524864", "86240491715320185517829365967129243283", "197494463814088336627407800758568112017", "164820060521441480337942670299694831489", "296341781001668297495381803555356229114", "63023319149774050960125992398873200987", "310568192335556860099790048577565682933"], "threshold":0.9}, "id":"ASB-A-503554165-7486c5b8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b97933907b9230a21c24e3d6c0504bedc0b5d7d0", "target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-09-01"}]}