{"id":"ASB-A-522372651", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-05T16:20:22.411518700Z", "aliases":["CVE-2026-49933", "A-522372651"], "details":"In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6505b430477940ff61355726ca3142fdd06fb21", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e"], "severity":"Critical", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"246723683549866751493573909455343009703", "length":2214}, "id":"ASB-A-522372651-019cf37e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"line_hashes":["158200819445386134177936295702955735382", "4139362980451998596924249030445462413", "52700284085879716159314448886049812034", "278176551384158374446664208198490782019", "227727791413726504713210430863008135539", "284360508867883407336331986827730315741", "88834029904996324001096239099578427898", "92705279026477912090603448568298029500", "61980072477478349696857769595441058214", "276457531786224781861024550526524829516", "88834029904996324001096239099578427898", "92705279026477912090603448568298029500", "142383761567626123287593292611143670631", "291546764864324326499317700349615109177", "88834029904996324001096239099578427898", "92705279026477912090603448568298029500"], "threshold":0.9}, "id":"ASB-A-522372651-693d31b8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger_test.cc"}}, {"deprecated":false, "digest":{"function_hash":"53881474740965101877136389325477858565", "length":2368}, "id":"ASB-A-522372651-76fbf901", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"line_hashes":["181266181211620693404888341813178027143", "111315914176387887908060969285383578850", "67711727113733261755631088289278506561", "287227742371283328038254616982367975574", "110032217682972160027158316572292798414", "68986527579664712575049020536452280705", "165560519134704901613096702864142530379", "31726614903768848027254149897412693371"], "threshold":0.9}, "id":"ASB-A-522372651-dd83c4cd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger.cc"}}, {"deprecated":false, "digest":{"function_hash":"154785654276675420321081737784626453063", "length":1169}, "id":"ASB-A-522372651-e6817602", "match_only_versions":["17-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger.cc", "function":"SnoopLogger::FilterCapturedPacket"}}, {"deprecated":false, "digest":{"function_hash":"70655787517642236018642036569526023589", "length":2308}, "id":"ASB-A-522372651-e7840df4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e", "target":{"file":"system/gd/hal/snoop_logger_test.cc", "function":"TEST_F"}}, {"deprecated":false, "digest":{"line_hashes":["76148413103271731899121825941573300569", "66375027220060361123405057356097300075", "149892852650925427595339894549322079331", "10511902240766966384980360183965725151", "44440862999974738080730458981300631505", "102300321447880512662430744442178689537", "3584694846551722812254284656324469761", "94138012884016884353096924181526005838", "216281551480449218498985854457346893077", "67676619318514079711580523900808032889", "215522082758937699142158417557752762867", "90089676231714011040094763376295454293", "158444981555462118554515511784046912300", "104460502824404623589389106265416528581", "146308764134443773681075912036504415125", "250772105855515439493340680585963382939", "129033694146773588137900648319427866633", "138201933555372318523173626329560722811", "2174671701754158878405658110462269965"], "threshold":0.9}, "id":"ASB-A-522372651-f1a96f69", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6505b430477940ff61355726ca3142fdd06fb21", "target":{"file":"system/gd/hci/msft.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/36c99237b7c142ed536a50437c4469458c305acc"], "severity":"Critical", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["76148413103271731899121825941573300569", "256598125464686523305569038459809660227", "192630044828646945181342389416891979310", "164589143938894441424901564913156904063", "197895003676535660363193259082123176920", "47925032755260285592581900767676206506", "171327422406183257184268499742856432070", "195611227293247267492451700308760093373", "77710769524471846873364039802291505844", "215522082758937699142158417557752762867", "90089676231714011040094763376295454293", "158444981555462118554515511784046912300", "104460502824404623589389106265416528581", "146308764134443773681075912036504415125", "307122447648904190709326264868412609920", "154380142658042416597917576875991075003", "58082490710001401943556762643069144757", "32894523238146086077765680443884859145"], "threshold":0.9}, "id":"ASB-A-522372651-c9e0236f", "match_only_versions":["16"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/36c99237b7c142ed536a50437c4469458c305acc", "target":{"file":"system/gd/hci/msft.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0099192812a2d453f61994f26acd0b906105066b"], "severity":"Critical", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["76148413103271731899121825941573300569", "256598125464686523305569038459809660227", "192630044828646945181342389416891979310", "164589143938894441424901564913156904063", "197895003676535660363193259082123176920", "47925032755260285592581900767676206506", "171327422406183257184268499742856432070", "195611227293247267492451700308760093373", "77710769524471846873364039802291505844", "215522082758937699142158417557752762867", "90089676231714011040094763376295454293", "158444981555462118554515511784046912300", "104460502824404623589389106265416528581", "146308764134443773681075912036504415125", "307122447648904190709326264868412609920", "154380142658042416597917576875991075003", "109025424290103957676336107121222133635", "2174671701754158878405658110462269965"], "threshold":0.9}, "id":"ASB-A-522372651-beb64a4c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0099192812a2d453f61994f26acd0b906105066b", "target":{"file":"system/gd/hci/msft.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec040a5dfc7e10cb92277191891b22e26548a0a4"], "severity":"Critical", "spl":"2026-10-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["76148413103271731899121825941573300569", "256598125464686523305569038459809660227", "192630044828646945181342389416891979310", "164589143938894441424901564913156904063", "197895003676535660363193259082123176920", "47925032755260285592581900767676206506", "171327422406183257184268499742856432070", "195611227293247267492451700308760093373", "77710769524471846873364039802291505844", "215522082758937699142158417557752762867", "90089676231714011040094763376295454293", "158444981555462118554515511784046912300", "104460502824404623589389106265416528581", "146308764134443773681075912036504415125", "250772105855515439493340680585963382939", "129033694146773588137900648319427866633", "138201933555372318523173626329560722811", "2174671701754158878405658110462269965"], "threshold":0.9}, "id":"ASB-A-522372651-8ca0e145", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec040a5dfc7e10cb92277191891b22e26548a0a4", "target":{"file":"system/gd/hci/msft.cc"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}