{"id":"ASB-A-251514171","details":"In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-251514171","CVE-2025-26438"],"modified":"2026-05-26T15:46:26.044149249Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e6130675c04752947ac4779c178ce70eb959a97f"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f5a7b3433c93e587bc5491b1647c208cfc04c38"],"vanir_signatures":[{"digest":{"function_hash":"107254158032908572902498059590686816099","length":1478},"deprecated":false,"target":{"function":"smp_process_secure_connection_oob_data","file":"system/stack/smp/smp_act.cc"},"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f5a7b3433c93e587bc5491b1647c208cfc04c38","signature_version":"v1","id":"ASB-A-251514171-33c77558"},{"id":"ASB-A-251514171-50c8b1d7","signature_version":"v1","target":{"file":"system/stack/smp/smp_act.cc"},"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f5a7b3433c93e587bc5491b1647c208cfc04c38","digest":{"threshold":0.9,"line_hashes":["169925125941823537600752468026067539694","113385753266922047354390093774613920887","95995477923874679239548703631812912981","178521878968928782378602093856495850943","222466249588433036185688638542666214903","22045282971727450260633747393179431458","197489951114962900942914413509197911311","198797200908979355331313755418372457948","309453622334382306353816301098314124138","127606651789028192380669981705663883234","202563545451616409801547758769826172190","11573155842480106439572378862971032968","184031576880264426989094457705577290909"]},"deprecated":false}],"severity":"High","types":["EoP"],"spl":"2025-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-251514171.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-05-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/faea50382d2b1932abac40b76507d9bcd374635e"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["134130937920452753674887637254696993259","231708506710858175866185609260707736235","147235756275927838069155532100272565165"]},"deprecated":false,"target":{"file":"system/stack/smp/smp_act.cc"},"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/faea50382d2b1932abac40b76507d9bcd374635e","signature_version":"v1","id":"ASB-A-251514171-0eca9eaf"},{"id":"ASB-A-251514171-7d5f0e05","signature_version":"v1","target":{"function":"smp_process_secure_connection_oob_data","file":"system/stack/smp/smp_act.cc"},"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/faea50382d2b1932abac40b76507d9bcd374635e","digest":{"function_hash":"198628309788322758344083288511938625723","length":1086},"deprecated":false}],"types":["EoP"],"spl":"2025-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-251514171.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-05-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["114632973770150251003126669934355297115","26568688585533256737126348896221948843","131396730146234005761979337859761040741"]},"signature_version":"v1","target":{"file":"system/stack/smp/smp_act.cc"},"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf","id":"ASB-A-251514171-535821b2","deprecated":false},{"digest":{"function_hash":"17155854342471303826645813739715962542","length":1132},"deprecated":false,"target":{"function":"smp_process_secure_connection_oob_data","file":"system/stack/smp/smp_act.cc"},"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf","signature_version":"v1","id":"ASB-A-251514171-bbf22fa8"}],"types":["EoP"],"spl":"2025-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-251514171.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-05-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf"],"vanir_signatures":[{"id":"ASB-A-251514171-06bf7a68","signature_version":"v1","target":{"file":"system/stack/smp/smp_act.cc"},"signature_type":"Line","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf","digest":{"threshold":0.9,"line_hashes":["114632973770150251003126669934355297115","26568688585533256737126348896221948843","131396730146234005761979337859761040741"]},"deprecated":false},{"digest":{"function_hash":"17155854342471303826645813739715962542","length":1132},"signature_version":"v1","target":{"function":"smp_process_secure_connection_oob_data","file":"system/stack/smp/smp_act.cc"},"signature_type":"Function","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf","id":"ASB-A-251514171-ceb070a5","deprecated":false}],"types":["EoP"],"spl":"2025-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-251514171.json"}}],"schema_version":"1.7.5"}