ASB-A-522372651

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-522372651.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-522372651
Aliases
  • A-522372651
  • CVE-2026-49933
Published
2026-10-01T00:00:00Z
Modified
2026-10-05T16:56:07Z
Summary
[none]
Details

In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17-next:0
Fixed
17-next:2026-10-01

Affected versions

Other
17-next

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6505b430477940ff61355726ca3142fdd06fb21",
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "246723683549866751493573909455343009703",
                "length":  2214
            },
            "id":  "ASB-A-522372651-019cf37e",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
            "target":  {
                "file":  "system/gd/hal/snoop_logger_test.cc",
                "function":  "TEST_F"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "158200819445386134177936295702955735382",
                    "4139362980451998596924249030445462413",
                    "52700284085879716159314448886049812034",
                    "278176551384158374446664208198490782019",
                    "227727791413726504713210430863008135539",
                    "284360508867883407336331986827730315741",
                    "88834029904996324001096239099578427898",
                    "92705279026477912090603448568298029500",
                    "61980072477478349696857769595441058214",
                    "276457531786224781861024550526524829516",
                    "88834029904996324001096239099578427898",
                    "92705279026477912090603448568298029500",
                    "142383761567626123287593292611143670631",
                    "291546764864324326499317700349615109177",
                    "88834029904996324001096239099578427898",
                    "92705279026477912090603448568298029500"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522372651-693d31b8",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
            "target":  {
                "file":  "system/gd/hal/snoop_logger_test.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "53881474740965101877136389325477858565",
                "length":  2368
            },
            "id":  "ASB-A-522372651-76fbf901",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
            "target":  {
                "file":  "system/gd/hal/snoop_logger_test.cc",
                "function":  "TEST_F"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "181266181211620693404888341813178027143",
                    "111315914176387887908060969285383578850",
                    "67711727113733261755631088289278506561",
                    "287227742371283328038254616982367975574",
                    "110032217682972160027158316572292798414",
                    "68986527579664712575049020536452280705",
                    "165560519134704901613096702864142530379",
                    "31726614903768848027254149897412693371"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522372651-dd83c4cd",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
            "target":  {
                "file":  "system/gd/hal/snoop_logger.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "154785654276675420321081737784626453063",
                "length":  1169
            },
            "id":  "ASB-A-522372651-e6817602",
            "match_only_versions":  [
                "17-next"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
            "target":  {
                "file":  "system/gd/hal/snoop_logger.cc",
                "function":  "SnoopLogger::FilterCapturedPacket"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "70655787517642236018642036569526023589",
                "length":  2308
            },
            "id":  "ASB-A-522372651-e7840df4",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e",
            "target":  {
                "file":  "system/gd/hal/snoop_logger_test.cc",
                "function":  "TEST_F"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76148413103271731899121825941573300569",
                    "66375027220060361123405057356097300075",
                    "149892852650925427595339894549322079331",
                    "10511902240766966384980360183965725151",
                    "44440862999974738080730458981300631505",
                    "102300321447880512662430744442178689537",
                    "3584694846551722812254284656324469761",
                    "94138012884016884353096924181526005838",
                    "216281551480449218498985854457346893077",
                    "67676619318514079711580523900808032889",
                    "215522082758937699142158417557752762867",
                    "90089676231714011040094763376295454293",
                    "158444981555462118554515511784046912300",
                    "104460502824404623589389106265416528581",
                    "146308764134443773681075912036504415125",
                    "250772105855515439493340680585963382939",
                    "129033694146773588137900648319427866633",
                    "138201933555372318523173626329560722811",
                    "2174671701754158878405658110462269965"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522372651-f1a96f69",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6505b430477940ff61355726ca3142fdd06fb21",
            "target":  {
                "file":  "system/gd/hci/msft.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-522372651.json"
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2026-10-01

Affected versions

Other
16

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/36c99237b7c142ed536a50437c4469458c305acc"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76148413103271731899121825941573300569",
                    "256598125464686523305569038459809660227",
                    "192630044828646945181342389416891979310",
                    "164589143938894441424901564913156904063",
                    "197895003676535660363193259082123176920",
                    "47925032755260285592581900767676206506",
                    "171327422406183257184268499742856432070",
                    "195611227293247267492451700308760093373",
                    "77710769524471846873364039802291505844",
                    "215522082758937699142158417557752762867",
                    "90089676231714011040094763376295454293",
                    "158444981555462118554515511784046912300",
                    "104460502824404623589389106265416528581",
                    "146308764134443773681075912036504415125",
                    "307122447648904190709326264868412609920",
                    "154380142658042416597917576875991075003",
                    "58082490710001401943556762643069144757",
                    "32894523238146086077765680443884859145"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522372651-c9e0236f",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/36c99237b7c142ed536a50437c4469458c305acc",
            "target":  {
                "file":  "system/gd/hci/msft.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-522372651.json"
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-qpr2:0
Fixed
16-qpr2:2026-10-01

Affected versions

Other
16-qpr2

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0099192812a2d453f61994f26acd0b906105066b"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76148413103271731899121825941573300569",
                    "256598125464686523305569038459809660227",
                    "192630044828646945181342389416891979310",
                    "164589143938894441424901564913156904063",
                    "197895003676535660363193259082123176920",
                    "47925032755260285592581900767676206506",
                    "171327422406183257184268499742856432070",
                    "195611227293247267492451700308760093373",
                    "77710769524471846873364039802291505844",
                    "215522082758937699142158417557752762867",
                    "90089676231714011040094763376295454293",
                    "158444981555462118554515511784046912300",
                    "104460502824404623589389106265416528581",
                    "146308764134443773681075912036504415125",
                    "307122447648904190709326264868412609920",
                    "154380142658042416597917576875991075003",
                    "109025424290103957676336107121222133635",
                    "2174671701754158878405658110462269965"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522372651-beb64a4c",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0099192812a2d453f61994f26acd0b906105066b",
            "target":  {
                "file":  "system/gd/hci/msft.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-522372651.json"
platform/packages/modules/Bluetooth

Package

Name
platform/packages/modules/Bluetooth

Affected ranges

Type
ECOSYSTEM
Events
Introduced
17:0
Fixed
17:2026-10-01

Affected versions

Other
17

Ecosystem specific 

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec040a5dfc7e10cb92277191891b22e26548a0a4"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "DoS"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "76148413103271731899121825941573300569",
                    "256598125464686523305569038459809660227",
                    "192630044828646945181342389416891979310",
                    "164589143938894441424901564913156904063",
                    "197895003676535660363193259082123176920",
                    "47925032755260285592581900767676206506",
                    "171327422406183257184268499742856432070",
                    "195611227293247267492451700308760093373",
                    "77710769524471846873364039802291505844",
                    "215522082758937699142158417557752762867",
                    "90089676231714011040094763376295454293",
                    "158444981555462118554515511784046912300",
                    "104460502824404623589389106265416528581",
                    "146308764134443773681075912036504415125",
                    "250772105855515439493340680585963382939",
                    "129033694146773588137900648319427866633",
                    "138201933555372318523173626329560722811",
                    "2174671701754158878405658110462269965"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522372651-8ca0e145",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec040a5dfc7e10cb92277191891b22e26548a0a4",
            "target":  {
                "file":  "system/gd/hci/msft.cc"
            }
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/android-osv/ASB-A-522372651.json"