ASB-A-242459126 — Vulnetix

ASB-A-242459126 PUBLISHED CVSS 8.600000381469727 HIGH

In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out of bounds reads due to integer overflows. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Risk Scores

CVSS v4.0

8.600000381469727

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

Vendor	Product	Versions
platform	packages/modules/Bluetooth	13:0, 13, 13:0
platform	system/bt	10:0, 10, 11:0

Timeline

Dec 1, 2022 CVE Published
May 15, 2026 CVE Updated

References

https://source.android.com/security/bulletin/2022-12-01 advisory
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8ac0a48db690b05eebb59fc84f18552b01ab8b2c patch

Open in Interactive Console →