{"id":"ASB-A-522373105", "published":"2026-10-01T00:00:00Z", "modified":"2026-10-06T15:36:24.859151902Z", "aliases":["CVE-2026-58880", "A-522373105"], "details":"In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-10-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["92349898900628523434251924885245726404", "132821318000631733850894742557044440786", "131226620104169995491696136052815213244", "152316497097907199971804673235854758854", "163450094143265197203783736975098988223", "54290254466645111406076916591093223932"], "threshold":0.9}, "id":"ASB-A-522373105-31a3dc34", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2", "target":{"file":"system/include/hardware/bt_rc.h"}}, {"deprecated":false, "digest":{"function_hash":"7000326074605733845825547348180708226", "length":1743}, "id":"ASB-A-522373105-4ffb42f9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_attr_txt_response"}}, {"deprecated":false, "digest":{"function_hash":"93999680276979206708495460895296181727", "length":2819}, "id":"ASB-A-522373105-62e8876c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_attr_val_txt_response"}}, {"deprecated":false, "digest":{"line_hashes":["31907738530266004767223499180471078385", "42509700709624815341762306891845359557", "187629592039708894437388644035483977944", "109304125008990616954655207580194774798", "33262424147565392208598365308188416223", "55592945859636309625759281069354282052", "262895922717953683162185094190667071577", "56272265255711785308652072750742032215", "33262424147565392208598365308188416223", "55592945859636309625759281069354282052", "262895922717953683162185094190667071577", "56272265255711785308652072750742032215", "143760596620956287193256397099551781642", "80952588686057987194869544417008441092", "40245853989966781629761310332584393389", "258633672919697322510258450771527830850", "59238394010665217226517265210623419016", "271060784739236877148115541743645247715", "312347054038796015635200793346867397188"], "threshold":0.9}, "id":"ASB-A-522373105-8b1de00a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2", "target":{"file":"system/btif/src/btif_rc.cc"}}, {"deprecated":false, "digest":{"line_hashes":["71852894101241296351986038488947516987", "245790275767766707221805364666164341607", "303941405824397751575163828883658314345", "213023372752609448292967345469032127102", "25849902745112574827078966910214551476", "304699192025357276231264465245632074962"], "threshold":0.9}, "id":"ASB-A-522373105-9001b90a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2", "target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"}}, {"deprecated":false, "digest":{"function_hash":"265056820738958798688822881799169412394", "length":1788}, "id":"ASB-A-522373105-a45900d7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_val_response"}}, {"deprecated":false, "digest":{"function_hash":"44511156494072803426444069525447064405", "length":1269}, "id":"ASB-A-522373105-a5d178bf", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2", "target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp", "function":"btavrcp_playerapplicationsetting_callback"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-10-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"53111948554782607706693951782171642594", "length":1641}, "id":"ASB-A-522373105-0346edc6", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_attr_txt_response"}}, {"deprecated":false, "digest":{"function_hash":"52059334469655989935411864956475233983", "length":1806}, "id":"ASB-A-522373105-09ba1b50", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_val_response"}}, {"deprecated":false, "digest":{"function_hash":"227900733609995822892809556835104348614", "length":1493}, "id":"ASB-A-522373105-702d6c9b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2", "target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp", "function":"btavrcp_playerapplicationsetting_callback"}}, {"deprecated":false, "digest":{"line_hashes":["306367619304702991884474815182280904801", "203140059624735935127373299724905299619", "309741182714389662418744654070236891838", "274238053738644898391094386936505014474", "76470796739631368161751004399827973931", "251635554509996764564635671514405603330", "225894735984986322904652040307173036598", "181167244862971031225029647920243855208", "76470796739631368161751004399827973931", "251635554509996764564635671514405603330", "225894735984986322904652040307173036598", "181167244862971031225029647920243855208", "140137449322196489207238102413967604118", "24418801201892551135042383862867891897", "317639409410531128743641614893155015114", "88892102447301918159282320469073287072", "87231120130862032198052599156935372425", "271060784739236877148115541743645247715", "312347054038796015635200793346867397188"], "threshold":0.9}, "id":"ASB-A-522373105-7284e41f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2", "target":{"file":"system/btif/src/btif_rc.cc"}}, {"deprecated":false, "digest":{"function_hash":"147667104775851454251568745577943895118", "length":2738}, "id":"ASB-A-522373105-810a48f7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_attr_val_txt_response"}}, {"deprecated":false, "digest":{"line_hashes":["92349898900628523434251924885245726404", "132821318000631733850894742557044440786", "131226620104169995491696136052815213244", "152316497097907199971804673235854758854", "163450094143265197203783736975098988223", "54290254466645111406076916591093223932"], "threshold":0.9}, "id":"ASB-A-522373105-ea4790bd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2", "target":{"file":"system/include/hardware/bt_rc.h"}}, {"deprecated":false, "digest":{"line_hashes":["71852894101241296351986038488947516987", "245790275767766707221805364666164341607", "303941405824397751575163828883658314345", "213023372752609448292967345469032127102", "25849902745112574827078966910214551476", "304699192025357276231264465245632074962"], "threshold":0.9}, "id":"ASB-A-522373105-face89bd", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2", "target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-10-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"53111948554782607706693951782171642594", "length":1641}, "id":"ASB-A-522373105-4f4dfdde", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_attr_txt_response"}}, {"deprecated":false, "digest":{"function_hash":"147667104775851454251568745577943895118", "length":2738}, "id":"ASB-A-522373105-90547b28", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_attr_val_txt_response"}}, {"deprecated":false, "digest":{"line_hashes":["92349898900628523434251924885245726404", "132821318000631733850894742557044440786", "131226620104169995491696136052815213244", "152316497097907199971804673235854758854", "163450094143265197203783736975098988223", "54290254466645111406076916591093223932"], "threshold":0.9}, "id":"ASB-A-522373105-96d254c6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e", "target":{"file":"system/include/hardware/bt_rc.h"}}, {"deprecated":false, "digest":{"line_hashes":["306367619304702991884474815182280904801", "203140059624735935127373299724905299619", "309741182714389662418744654070236891838", "274238053738644898391094386936505014474", "76470796739631368161751004399827973931", "251635554509996764564635671514405603330", "225894735984986322904652040307173036598", "181167244862971031225029647920243855208", "76470796739631368161751004399827973931", "251635554509996764564635671514405603330", "225894735984986322904652040307173036598", "181167244862971031225029647920243855208", "140137449322196489207238102413967604118", "24418801201892551135042383862867891897", "317639409410531128743641614893155015114", "88892102447301918159282320469073287072", "87231120130862032198052599156935372425", "271060784739236877148115541743645247715", "312347054038796015635200793346867397188"], "threshold":0.9}, "id":"ASB-A-522373105-a2a9b512", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e", "target":{"file":"system/btif/src/btif_rc.cc"}}, {"deprecated":false, "digest":{"line_hashes":["71852894101241296351986038488947516987", "245790275767766707221805364666164341607", "303941405824397751575163828883658314345", "213023372752609448292967345469032127102", "25849902745112574827078966910214551476", "304699192025357276231264465245632074962"], "threshold":0.9}, "id":"ASB-A-522373105-d2b00e6c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e", "target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"}}, {"deprecated":false, "digest":{"function_hash":"215140233181415166424540646329338171858", "length":1508}, "id":"ASB-A-522373105-db71bac7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e", "target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp", "function":"btavrcp_playerapplicationsetting_callback"}}, {"deprecated":false, "digest":{"function_hash":"52059334469655989935411864956475233983", "length":1806}, "id":"ASB-A-522373105-fe605c16", "match_only_versions":["16-qpr2"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_val_response"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17:0"}, {"fixed":"17:2026-10-01"}]}], "versions":["17"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2"], "severity":"Critical", "spl":"2026-10-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["92349898900628523434251924885245726404", "132821318000631733850894742557044440786", "131226620104169995491696136052815213244", "152316497097907199971804673235854758854", "163450094143265197203783736975098988223", "54290254466645111406076916591093223932"], "threshold":0.9}, "id":"ASB-A-522373105-1dcea58f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2", "target":{"file":"system/include/hardware/bt_rc.h"}}, {"deprecated":false, "digest":{"function_hash":"28690532868144863262195843228350752810", "length":1620}, "id":"ASB-A-522373105-1ff1b852", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_attr_txt_response"}}, {"deprecated":false, "digest":{"line_hashes":["94705217822802792880050304455477950891", "332988480452181712278670145465443416508", "321214346419254076731542669103180338615", "109304125008990616954655207580194774798", "113953626761456538609130337235615086627", "203321376258664323151842714421928331192", "325293239017189394284368021717764616407", "56272265255711785308652072750742032215", "113953626761456538609130337235615086627", "203321376258664323151842714421928331192", "325293239017189394284368021717764616407", "56272265255711785308652072750742032215", "218877437539500692202352836435212166282", "113839794097897826081218158153118106690", "85521260511569383279676910488384503714", "258633672919697322510258450771527830850", "59238394010665217226517265210623419016", "271060784739236877148115541743645247715", "312347054038796015635200793346867397188"], "threshold":0.9}, "id":"ASB-A-522373105-4c662e8e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2", "target":{"file":"system/btif/src/btif_rc.cc"}}, {"deprecated":false, "digest":{"function_hash":"137948342842671820732905788622141982188", "length":1785}, "id":"ASB-A-522373105-7e961765", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_val_response"}}, {"deprecated":false, "digest":{"line_hashes":["71852894101241296351986038488947516987", "245790275767766707221805364666164341607", "303941405824397751575163828883658314345", "213023372752609448292967345469032127102", "25849902745112574827078966910214551476", "304699192025357276231264465245632074962"], "threshold":0.9}, "id":"ASB-A-522373105-90ae946e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2", "target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"}}, {"deprecated":false, "digest":{"function_hash":"333214778591261047789018205870651766285", "length":2696}, "id":"ASB-A-522373105-d407fc0b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2", "target":{"file":"system/btif/src/btif_rc.cc", "function":"handle_app_attr_val_txt_response"}}, {"deprecated":false, "digest":{"function_hash":"44511156494072803426444069525447064405", "length":1269}, "id":"ASB-A-522373105-d95c70e0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2", "target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp", "function":"btavrcp_playerapplicationsetting_callback"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-10-01"}]}