ASB-A-239414876 — Vulnetix

ASB-A-239414876 PUBLISHED CVSS 8.600000381469727 HIGH

In sdpu_build_uuid_seq of sdp_discovery.cc, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk Scores

CVSS v4.0

8.600000381469727

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

Vendor	Product	Versions
platform	packages/modules/Bluetooth	13-next, 13, *

Timeline

Jun 1, 2023 CVE Published
May 15, 2026 CVE Updated

References

https://source.android.com/security/bulletin/2023-06-01 advisory
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bb458314f98712c39749f8e2fae42df864bf5347 patch

Open in Interactive Console →