{"id":"ASB-A-251514171","details":"In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-251514171","CVE-2025-26438"],"modified":"2026-09-21T16:00:45.521740994Z","published":"2025-05-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-05-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e6130675c04752947ac4779c178ce70eb959a97f"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-05-01"}]}],"versions":["15-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f5a7b3433c93e587bc5491b1647c208cfc04c38"],"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-251514171-33c77558","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f5a7b3433c93e587bc5491b1647c208cfc04c38","target":{"function":"smp_process_secure_connection_oob_data","file":"system/stack/smp/smp_act.cc"},"deprecated":false,"digest":{"function_hash":"107254158032908572902498059590686816099","length":1478}},{"digest":{"line_hashes":["169925125941823537600752468026067539694","113385753266922047354390093774613920887","95995477923874679239548703631812912981","178521878968928782378602093856495850943","222466249588433036185688638542666214903","22045282971727450260633747393179431458","197489951114962900942914413509197911311","198797200908979355331313755418372457948","309453622334382306353816301098314124138","127606651789028192380669981705663883234","202563545451616409801547758769826172190","11573155842480106439572378862971032968","184031576880264426989094457705577290909"],"threshold":0.9},"id":"ASB-A-251514171-50c8b1d7","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f5a7b3433c93e587bc5491b1647c208cfc04c38","target":{"file":"system/stack/smp/smp_act.cc"},"deprecated":false}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-251514171.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-05-01"}]}],"versions":["15"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/faea50382d2b1932abac40b76507d9bcd374635e"],"severity":"High","spl":"2025-05-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/faea50382d2b1932abac40b76507d9bcd374635e","target":{"file":"system/stack/smp/smp_act.cc"},"deprecated":false,"digest":{"line_hashes":["134130937920452753674887637254696993259","231708506710858175866185609260707736235","147235756275927838069155532100272565165"],"threshold":0.9},"id":"ASB-A-251514171-0eca9eaf","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-251514171-7d5f0e05","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/faea50382d2b1932abac40b76507d9bcd374635e","target":{"file":"system/stack/smp/smp_act.cc","function":"smp_process_secure_connection_oob_data"},"deprecated":false,"digest":{"function_hash":"198628309788322758344083288511938625723","length":1086}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-251514171.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-05-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-251514171-535821b2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf","target":{"file":"system/stack/smp/smp_act.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["114632973770150251003126669934355297115","26568688585533256737126348896221948843","131396730146234005761979337859761040741"]}},{"target":{"file":"system/stack/smp/smp_act.cc","function":"smp_process_secure_connection_oob_data"},"deprecated":false,"digest":{"function_hash":"17155854342471303826645813739715962542","length":1132},"id":"ASB-A-251514171-bbf22fa8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf"],"severity":"High","spl":"2025-05-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-251514171.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-05-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-251514171-06bf7a68","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf","target":{"file":"system/stack/smp/smp_act.cc"},"deprecated":false,"digest":{"line_hashes":["114632973770150251003126669934355297115","26568688585533256737126348896221948843","131396730146234005761979337859761040741"],"threshold":0.9}},{"digest":{"function_hash":"17155854342471303826645813739715962542","length":1132},"id":"ASB-A-251514171-ceb070a5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf","target":{"file":"system/stack/smp/smp_act.cc","function":"smp_process_secure_connection_oob_data"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/eb5e369706a6698769bc37f9afc1f386d822efcf"],"severity":"High","spl":"2025-05-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-251514171.json"}}],"schema_version":"1.9.0"}