ASB-A-232023771 — Vulnetix

ASB-A-232023771 PUBLISHED CVSS 8.600000381469727 HIGH

In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk Scores

CVSS 4.0

8.600000381469727

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

Vendor	Product	Versions
platform	system/bt	12, 10:0, 10
platform	packages/modules/Bluetooth	13, *, 13:0

Timeline

Dec 1, 2022 CVE Published
May 15, 2026 CVE Updated

References

https://source.android.com/security/bulletin/2022-12-01 advisory
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/9f083ec910ec38ba7ba04443b126f66ef33972b4 patch
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/493fcadb4111608f364df2b9c31bdc0234ac527a patch

Open in Interactive Console →