{"id":"ASB-A-455566331","details":"In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-455566331","CVE-2026-28627"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e","target":{"file":"system/stack/btm/btm_sec.cc","function":"btm_sec_encrypt_change"},"deprecated":false,"digest":{"length":6807,"function_hash":"205822490183520084071808805550573095980"},"id":"ASB-A-455566331-22f85846","signature_type":"Function"},{"target":{"file":"system/stack/btm/btm_sec.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["266911383651849706627189516025474655044","22746015159294279785369247517525573417","16822600875316432780509451369327459240","69506406385031247304147542052227090042","234778014219492089925774012715693957129"]},"id":"ASB-A-455566331-3d315cb2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e"},{"deprecated":false,"digest":{"function_hash":"246751366734274379694686193180412433198","length":6571},"id":"ASB-A-455566331-ca99018e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d","target":{"file":"system/stack/btm/btm_sec.cc","function":"btm_sec_encrypt_change"}},{"digest":{"line_hashes":["256691374848977035078864017690569886985","179598493196210115821858848815657945457","195880702532091725239692041728703023238","229929706873943957283950205701308384880"],"threshold":0.9},"id":"ASB-A-455566331-e58bc75c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d","target":{"file":"system/stack/btm/btm_sec.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/13872784a01e3d244ef955465515187c42bf293d","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b3a91968ea3b4a057d354ef40ede6fbf212a7c8e"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-455566331.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["48621335918798919918337838781628094397","315922361224175920817306337553823066528","58505352865503788653323961472191447681","241788827861155263427171009912068500749","5083288000807364608694487327912323228","231136603987698915759560593421910865940"],"threshold":0.9},"id":"ASB-A-455566331-b0a3f646","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e","target":{"file":"system/stack/btm/btm_sec_utils.cc"}},{"target":{"file":"system/stack/btm/btm_sec.cc","function":"btm_sec_encrypt_change"},"deprecated":false,"digest":{"function_hash":"311209934801716296561149952539486379434","length":6070},"id":"ASB-A-455566331-d298bb19","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["73604516503037035217799911193538492959","13432903150882513040862906307534883967","113106014658141633640494704114389900491","94887924795509970787836457779110026018"]},"id":"ASB-A-455566331-e8cc0977","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e","target":{"file":"system/stack/btm/btm_sec.cc"}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e","target":{"file":"system/stack/btm/btm_sec_utils.cc","function":"btm_sec_is_enc_algo_downgrade"},"deprecated":false,"digest":{"function_hash":"196905764144984863732894774175353669607","length":732},"id":"ASB-A-455566331-fc2ca36b","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/75e12a42313fe94a8e53ed9a35eecfbb0144cb0e"],"severity":"High","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-455566331.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"spl":"2026-09-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45","target":{"function":"btm_sec_encrypt_change","file":"system/stack/btm/btm_sec.cc"},"deprecated":false,"digest":{"function_hash":"246751366734274379694686193180412433198","length":6571},"id":"ASB-A-455566331-9fe2bdfa","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["256691374848977035078864017690569886985","179598493196210115821858848815657945457","195880702532091725239692041728703023238","229929706873943957283950205701308384880"]},"id":"ASB-A-455566331-f5d9d990","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45","target":{"file":"system/stack/btm/btm_sec.cc"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/f531858aba8cbcc1c502f1efb77247d0bcf69d45"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-455566331.json"}}],"schema_version":"1.9.0"}