{"id":"ASB-A-522372274", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-55269", "A-522372274"], "details":"In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"246723683549866751493573909455343009703", "length":2214}, "id":"ASB-A-522372274-019cf37e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"line_hashes":["158200819445386134177936295702955735382", "4139362980451998596924249030445462413", "52700284085879716159314448886049812034", "278176551384158374446664208198490782019", "227727791413726504713210430863008135539", "284360508867883407336331986827730315741", "88834029904996324001096239099578427898", "92705279026477912090603448568298029500", "61980072477478349696857769595441058214", "276457531786224781861024550526524829516", "88834029904996324001096239099578427898", "92705279026477912090603448568298029500", "142383761567626123287593292611143670631", "291546764864324326499317700349615109177", "88834029904996324001096239099578427898", "92705279026477912090603448568298029500"], "threshold":0.9}, "id":"ASB-A-522372274-693d31b8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger_test.cc"}}, {"deprecated":false, "digest":{"function_hash":"53881474740965101877136389325477858565", "length":2368}, "id":"ASB-A-522372274-76fbf901", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"line_hashes":["181266181211620693404888341813178027143", "111315914176387887908060969285383578850", "67711727113733261755631088289278506561", "287227742371283328038254616982367975574", "110032217682972160027158316572292798414", "68986527579664712575049020536452280705", "165560519134704901613096702864142530379", "31726614903768848027254149897412693371"], "threshold":0.9}, "id":"ASB-A-522372274-dd83c4cd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger.cc"}}, {"deprecated":false, "digest":{"function_hash":"154785654276675420321081737784626453063", "length":1169}, "id":"ASB-A-522372274-e6817602", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger.cc", "function":"SnoopLogger::FilterCapturedPacket"}}, {"deprecated":false, "digest":{"function_hash":"70655787517642236018642036569526023589", "length":2308}, "id":"ASB-A-522372274-e7840df4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["158200819445386134177936295702955735382", "159340739937812780364119428540289608176", "143616464578955397402840977931471802203", "270051686240950753391803267439821806406", "243856159923083137177934890444295057046", "37477872440081306302429574114126351682", "10906170983236239424446484760233750396", "128338104743417124645645249388208906869", "96790392763558237854259834734548278251", "253104428708453886646675825165333747950", "10906170983236239424446484760233750396", "128338104743417124645645249388208906869", "41222755738157882998136448067610047202", "66912489947180533097094676553911762320", "10906170983236239424446484760233750396", "128338104743417124645645249388208906869"], "threshold":0.9}, "id":"ASB-A-522372274-0b4cd1de", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2", "target":{"file":"system/gd/hal/snoop_logger_test.cc"}}, {"deprecated":false, "digest":{"line_hashes":["181266181211620693404888341813178027143", "111315914176387887908060969285383578850", "67711727113733261755631088289278506561", "287227742371283328038254616982367975574", "110032217682972160027158316572292798414", "68986527579664712575049020536452280705", "165560519134704901613096702864142530379", "218934215270707795717059640916324652136"], "threshold":0.9}, "id":"ASB-A-522372274-297fc37d", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2", "target":{"file":"system/gd/hal/snoop_logger.cc"}}, {"deprecated":false, "digest":{"function_hash":"272561556308199201574688824678322626068", "length":2356}, "id":"ASB-A-522372274-496dac9c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"function_hash":"56353602535859068876142244014369506990", "length":2206}, "id":"ASB-A-522372274-64f56a04", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"function_hash":"154785654276675420321081737784626453063", "length":1169}, "id":"ASB-A-522372274-86e0d577", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2", "target":{"file":"system/gd/hal/snoop_logger.cc", "function":"SnoopLogger::FilterCapturedPacket"}}, {"deprecated":false, "digest":{"function_hash":"95097682103312222007963273808788505444", "length":2296}, "id":"ASB-A-522372274-d86876a5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"324712479278546019856595874635751708652", "length":2339}, "id":"ASB-A-522372274-00f918c2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_P"}}, {"deprecated":false, "digest":{"line_hashes":["181266181211620693404888341813178027143", "111315914176387887908060969285383578850", "67711727113733261755631088289278506561", "287227742371283328038254616982367975574", "110032217682972160027158316572292798414", "68986527579664712575049020536452280705", "165560519134704901613096702864142530379", "218934215270707795717059640916324652136"], "threshold":0.9}, "id":"ASB-A-522372274-33921bde", "match_only_versions":["16-qpr2"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f", "target":{"file":"system/gd/hal/snoop_logger.cc"}}, {"deprecated":false, "digest":{"function_hash":"67988436774633188839018039484509107849", "length":2279}, "id":"ASB-A-522372274-35171c01", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_P"}}, {"deprecated":false, "digest":{"function_hash":"139365611964801789489041589329465866357", "length":2185}, "id":"ASB-A-522372274-73321647", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_P"}}, {"deprecated":false, "digest":{"function_hash":"154785654276675420321081737784626453063", "length":1169}, "id":"ASB-A-522372274-73d6e2c1", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f", "target":{"file":"system/gd/hal/snoop_logger.cc", "function":"SnoopLogger::FilterCapturedPacket"}}, {"deprecated":false, "digest":{"line_hashes":["158200819445386134177936295702955735382", "159340739937812780364119428540289608176", "226320844949627900547404198377861839510", "137224853085218192034372402784443378162", "144859298578910593299839899813533889769", "275683301262758940741517646966636469166", "115685458349649471316638526311136713507", "135851685212389741440220350346353913076", "134057159010788262199221789100292437519", "121015403339208641216625176641607250510", "115685458349649471316638526311136713507", "135851685212389741440220350346353913076", "34460787386938890624601772986775870578", "261158253999439962320839955450714563160", "115685458349649471316638526311136713507", "135851685212389741440220350346353913076"], "threshold":0.9}, "id":"ASB-A-522372274-b3c35770", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f", "target":{"file":"system/gd/hal/snoop_logger_test.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"324712479278546019856595874635751708652", "length":2339}, "id":"ASB-A-522372274-50e64505", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"line_hashes":["158200819445386134177936295702955735382", "159340739937812780364119428540289608176", "324084327174832942660876930286649249108", "144720227613865487604087824177827442292", "144859298578910593299839899813533889769", "275683301262758940741517646966636469166", "115685458349649471316638526311136713507", "135851685212389741440220350346353913076", "134057159010788262199221789100292437519", "121015403339208641216625176641607250510", "115685458349649471316638526311136713507", "135851685212389741440220350346353913076", "34460787386938890624601772986775870578", "261158253999439962320839955450714563160", "115685458349649471316638526311136713507", "135851685212389741440220350346353913076"], "threshold":0.9}, "id":"ASB-A-522372274-7245b09b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405", "target":{"file":"system/gd/hal/snoop_logger_test.cc"}}, {"deprecated":false, "digest":{"function_hash":"139365611964801789489041589329465866357", "length":2185}, "id":"ASB-A-522372274-8976281c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"function_hash":"67988436774633188839018039484509107849", "length":2279}, "id":"ASB-A-522372274-a253c174", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"function_hash":"154785654276675420321081737784626453063", "length":1169}, "id":"ASB-A-522372274-b5704b9d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405", "target":{"file":"system/gd/hal/snoop_logger.cc", "function":"SnoopLogger::FilterCapturedPacket"}}, {"deprecated":false, "digest":{"line_hashes":["181266181211620693404888341813178027143", "111315914176387887908060969285383578850", "67711727113733261755631088289278506561", "287227742371283328038254616982367975574", "110032217682972160027158316572292798414", "68986527579664712575049020536452280705", "165560519134704901613096702864142530379", "218934215270707795717059640916324652136"], "threshold":0.9}, "id":"ASB-A-522372274-e89df3e3", "match_only_versions":["17"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405", "target":{"file":"system/gd/hal/snoop_logger.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}