ASB-A-522373105

See a problem?

Import Source

https://storage.googleapis.com/android-osv/ASB-A-522373105.json

JSON Data

https://api.osv.dev/v1/vulns/ASB-A-522373105

Aliases

A-522373105
CVE-2026-58880

Published

2026-10-01T00:00:00Z

Modified

2026-10-05T16:41:14Z

Summary

[none]

Details

In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References

https://source.android.com/security/bulletin/2026-10-01

Affected packages

Android

platform/packages/modules/Bluetooth

Package

Name: platform/packages/modules/Bluetooth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17-next:0

Fixed

17-next:2026-10-01

Affected versions

Other

17-next

Ecosystem specific

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "92349898900628523434251924885245726404",
                    "132821318000631733850894742557044440786",
                    "131226620104169995491696136052815213244",
                    "152316497097907199971804673235854758854",
                    "163450094143265197203783736975098988223",
                    "54290254466645111406076916591093223932"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-31a3dc34",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2",
            "target":  {
                "file":  "system/include/hardware/bt_rc.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "7000326074605733845825547348180708226",
                "length":  1743
            },
            "id":  "ASB-A-522373105-4ffb42f9",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_attr_txt_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "93999680276979206708495460895296181727",
                "length":  2819
            },
            "id":  "ASB-A-522373105-62e8876c",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_attr_val_txt_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "31907738530266004767223499180471078385",
                    "42509700709624815341762306891845359557",
                    "187629592039708894437388644035483977944",
                    "109304125008990616954655207580194774798",
                    "33262424147565392208598365308188416223",
                    "55592945859636309625759281069354282052",
                    "262895922717953683162185094190667071577",
                    "56272265255711785308652072750742032215",
                    "33262424147565392208598365308188416223",
                    "55592945859636309625759281069354282052",
                    "262895922717953683162185094190667071577",
                    "56272265255711785308652072750742032215",
                    "143760596620956287193256397099551781642",
                    "80952588686057987194869544417008441092",
                    "40245853989966781629761310332584393389",
                    "258633672919697322510258450771527830850",
                    "59238394010665217226517265210623419016",
                    "271060784739236877148115541743645247715",
                    "312347054038796015635200793346867397188"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-8b1de00a",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "71852894101241296351986038488947516987",
                    "245790275767766707221805364666164341607",
                    "303941405824397751575163828883658314345",
                    "213023372752609448292967345469032127102",
                    "25849902745112574827078966910214551476",
                    "304699192025357276231264465245632074962"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-9001b90a",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2",
            "target":  {
                "file":  "android/app/jni/com_android_bluetooth_avrcp_controller.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "265056820738958798688822881799169412394",
                "length":  1788
            },
            "id":  "ASB-A-522373105-a45900d7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_val_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "44511156494072803426444069525447064405",
                "length":  1269
            },
            "id":  "ASB-A-522373105-a5d178bf",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2",
            "target":  {
                "file":  "android/app/jni/com_android_bluetooth_avrcp_controller.cpp",
                "function":  "btavrcp_playerapplicationsetting_callback"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-522373105.json"

platform/packages/modules/Bluetooth

Package

Name: platform/packages/modules/Bluetooth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16:0

Fixed

16:2026-10-01

Affected versions

Other

Ecosystem specific

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "53111948554782607706693951782171642594",
                "length":  1641
            },
            "id":  "ASB-A-522373105-0346edc6",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_attr_txt_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "52059334469655989935411864956475233983",
                "length":  1806
            },
            "id":  "ASB-A-522373105-09ba1b50",
            "match_only_versions":  [
                "16"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_val_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "227900733609995822892809556835104348614",
                "length":  1493
            },
            "id":  "ASB-A-522373105-702d6c9b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2",
            "target":  {
                "file":  "android/app/jni/com_android_bluetooth_avrcp_controller.cpp",
                "function":  "btavrcp_playerapplicationsetting_callback"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "306367619304702991884474815182280904801",
                    "203140059624735935127373299724905299619",
                    "309741182714389662418744654070236891838",
                    "274238053738644898391094386936505014474",
                    "76470796739631368161751004399827973931",
                    "251635554509996764564635671514405603330",
                    "225894735984986322904652040307173036598",
                    "181167244862971031225029647920243855208",
                    "76470796739631368161751004399827973931",
                    "251635554509996764564635671514405603330",
                    "225894735984986322904652040307173036598",
                    "181167244862971031225029647920243855208",
                    "140137449322196489207238102413967604118",
                    "24418801201892551135042383862867891897",
                    "317639409410531128743641614893155015114",
                    "88892102447301918159282320469073287072",
                    "87231120130862032198052599156935372425",
                    "271060784739236877148115541743645247715",
                    "312347054038796015635200793346867397188"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-7284e41f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "147667104775851454251568745577943895118",
                "length":  2738
            },
            "id":  "ASB-A-522373105-810a48f7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_attr_val_txt_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "92349898900628523434251924885245726404",
                    "132821318000631733850894742557044440786",
                    "131226620104169995491696136052815213244",
                    "152316497097907199971804673235854758854",
                    "163450094143265197203783736975098988223",
                    "54290254466645111406076916591093223932"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-ea4790bd",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2",
            "target":  {
                "file":  "system/include/hardware/bt_rc.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "71852894101241296351986038488947516987",
                    "245790275767766707221805364666164341607",
                    "303941405824397751575163828883658314345",
                    "213023372752609448292967345469032127102",
                    "25849902745112574827078966910214551476",
                    "304699192025357276231264465245632074962"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-face89bd",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2",
            "target":  {
                "file":  "android/app/jni/com_android_bluetooth_avrcp_controller.cpp"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-522373105.json"

platform/packages/modules/Bluetooth

Package

Name: platform/packages/modules/Bluetooth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

16-qpr2:0

Fixed

16-qpr2:2026-10-01

Affected versions

Other

16-qpr2

Ecosystem specific

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "53111948554782607706693951782171642594",
                "length":  1641
            },
            "id":  "ASB-A-522373105-4f4dfdde",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_attr_txt_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "147667104775851454251568745577943895118",
                "length":  2738
            },
            "id":  "ASB-A-522373105-90547b28",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_attr_val_txt_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "92349898900628523434251924885245726404",
                    "132821318000631733850894742557044440786",
                    "131226620104169995491696136052815213244",
                    "152316497097907199971804673235854758854",
                    "163450094143265197203783736975098988223",
                    "54290254466645111406076916591093223932"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-96d254c6",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e",
            "target":  {
                "file":  "system/include/hardware/bt_rc.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "306367619304702991884474815182280904801",
                    "203140059624735935127373299724905299619",
                    "309741182714389662418744654070236891838",
                    "274238053738644898391094386936505014474",
                    "76470796739631368161751004399827973931",
                    "251635554509996764564635671514405603330",
                    "225894735984986322904652040307173036598",
                    "181167244862971031225029647920243855208",
                    "76470796739631368161751004399827973931",
                    "251635554509996764564635671514405603330",
                    "225894735984986322904652040307173036598",
                    "181167244862971031225029647920243855208",
                    "140137449322196489207238102413967604118",
                    "24418801201892551135042383862867891897",
                    "317639409410531128743641614893155015114",
                    "88892102447301918159282320469073287072",
                    "87231120130862032198052599156935372425",
                    "271060784739236877148115541743645247715",
                    "312347054038796015635200793346867397188"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-a2a9b512",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "71852894101241296351986038488947516987",
                    "245790275767766707221805364666164341607",
                    "303941405824397751575163828883658314345",
                    "213023372752609448292967345469032127102",
                    "25849902745112574827078966910214551476",
                    "304699192025357276231264465245632074962"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-d2b00e6c",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e",
            "target":  {
                "file":  "android/app/jni/com_android_bluetooth_avrcp_controller.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "215140233181415166424540646329338171858",
                "length":  1508
            },
            "id":  "ASB-A-522373105-db71bac7",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e",
            "target":  {
                "file":  "android/app/jni/com_android_bluetooth_avrcp_controller.cpp",
                "function":  "btavrcp_playerapplicationsetting_callback"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "52059334469655989935411864956475233983",
                "length":  1806
            },
            "id":  "ASB-A-522373105-fe605c16",
            "match_only_versions":  [
                "16-qpr2"
            ],
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_val_response"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-522373105.json"

platform/packages/modules/Bluetooth

Package

Name: platform/packages/modules/Bluetooth

Affected ranges

Type: ECOSYSTEM
Events: Introduced

17:0

Fixed

17:2026-10-01

Affected versions

Other

Ecosystem specific

{
    "fixes":  [
        "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2"
    ],
    "severity":  "Critical",
    "spl":  "2026-10-01",
    "types":  [
        "EoP"
    ],
    "vanir_signatures":  [
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "92349898900628523434251924885245726404",
                    "132821318000631733850894742557044440786",
                    "131226620104169995491696136052815213244",
                    "152316497097907199971804673235854758854",
                    "163450094143265197203783736975098988223",
                    "54290254466645111406076916591093223932"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-1dcea58f",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2",
            "target":  {
                "file":  "system/include/hardware/bt_rc.h"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "28690532868144863262195843228350752810",
                "length":  1620
            },
            "id":  "ASB-A-522373105-1ff1b852",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_attr_txt_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "94705217822802792880050304455477950891",
                    "332988480452181712278670145465443416508",
                    "321214346419254076731542669103180338615",
                    "109304125008990616954655207580194774798",
                    "113953626761456538609130337235615086627",
                    "203321376258664323151842714421928331192",
                    "325293239017189394284368021717764616407",
                    "56272265255711785308652072750742032215",
                    "113953626761456538609130337235615086627",
                    "203321376258664323151842714421928331192",
                    "325293239017189394284368021717764616407",
                    "56272265255711785308652072750742032215",
                    "218877437539500692202352836435212166282",
                    "113839794097897826081218158153118106690",
                    "85521260511569383279676910488384503714",
                    "258633672919697322510258450771527830850",
                    "59238394010665217226517265210623419016",
                    "271060784739236877148115541743645247715",
                    "312347054038796015635200793346867397188"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-4c662e8e",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "137948342842671820732905788622141982188",
                "length":  1785
            },
            "id":  "ASB-A-522373105-7e961765",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_val_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "line_hashes":  [
                    "71852894101241296351986038488947516987",
                    "245790275767766707221805364666164341607",
                    "303941405824397751575163828883658314345",
                    "213023372752609448292967345469032127102",
                    "25849902745112574827078966910214551476",
                    "304699192025357276231264465245632074962"
                ],
                "threshold":  0.9
            },
            "id":  "ASB-A-522373105-90ae946e",
            "signature_type":  "Line",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2",
            "target":  {
                "file":  "android/app/jni/com_android_bluetooth_avrcp_controller.cpp"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "333214778591261047789018205870651766285",
                "length":  2696
            },
            "id":  "ASB-A-522373105-d407fc0b",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2",
            "target":  {
                "file":  "system/btif/src/btif_rc.cc",
                "function":  "handle_app_attr_val_txt_response"
            }
        },
        {
            "deprecated":  false,
            "digest":  {
                "function_hash":  "44511156494072803426444069525447064405",
                "length":  1269
            },
            "id":  "ASB-A-522373105-d95c70e0",
            "signature_type":  "Function",
            "signature_version":  "v1",
            "source":  "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2",
            "target":  {
                "file":  "android/app/jni/com_android_bluetooth_avrcp_controller.cpp",
                "function":  "btavrcp_playerapplicationsetting_callback"
            }
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/android-osv/ASB-A-522373105.json"