{"id":"ASB-A-522371916", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-58835", "A-522371916"], "details":"In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c9a1097e4ce11c2ac0f37a7609b238a7ceb93283"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["234365411249603989300082848016241845850", "165996928546326576649106371421315152636", "158131361413690883931020199603272946081", "295861833383985112459878393759501967827"], "threshold":0.9}, "id":"ASB-A-522371916-acb7e5cb", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c9a1097e4ce11c2ac0f37a7609b238a7ceb93283", "target":{"file":"system/btif/src/btif_storage.cc"}}, {"deprecated":false, "digest":{"function_hash":"223958912590250574146431880509876080730", "length":4806}, "id":"ASB-A-522371916-c9c59695", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c9a1097e4ce11c2ac0f37a7609b238a7ceb93283", "target":{"file":"system/btif/src/btif_storage.cc", "function":"cfg2prop"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/95ecd904327158fc73ed6b156502f209fc3f8f6f"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"114990799775487248829439979965956309753", "length":5327}, "id":"ASB-A-522371916-4357aac8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/95ecd904327158fc73ed6b156502f209fc3f8f6f", "target":{"file":"system/btif/src/btif_storage.cc", "function":"cfg2prop"}}, {"deprecated":false, "digest":{"line_hashes":["234365411249603989300082848016241845850", "165996928546326576649106371421315152636", "158131361413690883931020199603272946081", "295861833383985112459878393759501967827"], "threshold":0.9}, "id":"ASB-A-522371916-58fd875b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/95ecd904327158fc73ed6b156502f209fc3f8f6f", "target":{"file":"system/btif/src/btif_storage.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/15a1f089db2c8ac5ad2c5cb3df5c4b8825c9be7c"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["234365411249603989300082848016241845850", "165996928546326576649106371421315152636", "158131361413690883931020199603272946081", "295861833383985112459878393759501967827"], "threshold":0.9}, "id":"ASB-A-522371916-236068a0", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/15a1f089db2c8ac5ad2c5cb3df5c4b8825c9be7c", "target":{"file":"system/btif/src/btif_storage.cc"}}, {"deprecated":false, "digest":{"function_hash":"307183483111849039018821062906620333632", "length":5601}, "id":"ASB-A-522371916-cb571b9a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/15a1f089db2c8ac5ad2c5cb3df5c4b8825c9be7c", "target":{"file":"system/btif/src/btif_storage.cc", "function":"cfg2prop"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f6f30f9f5c32a41a461f7066d1858a9422967467"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"118676255921628993911651670726902938863", "length":5040}, "id":"ASB-A-522371916-4914ea68", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f6f30f9f5c32a41a461f7066d1858a9422967467", "target":{"file":"system/btif/src/btif_storage.cc", "function":"cfg2prop"}}, {"deprecated":false, "digest":{"line_hashes":["234365411249603989300082848016241845850", "165996928546326576649106371421315152636", "158131361413690883931020199603272946081", "295861833383985112459878393759501967827"], "threshold":0.9}, "id":"ASB-A-522371916-8c186c67", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f6f30f9f5c32a41a461f7066d1858a9422967467", "target":{"file":"system/btif/src/btif_storage.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}