{"id":"ASB-A-503554165","details":"In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-503554165","CVE-2026-45515"],"modified":"2026-09-09T15:15:54.249544283Z","published":"2026-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-09-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-09-01"}]}],"versions":["17-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e87caba4b8dfdb826c1d4b7cbb8a192d31ce7e85"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e87caba4b8dfdb826c1d4b7cbb8a192d31ce7e85","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc","function":"a2dp_vendor_opus_decoder_decode_packet"},"deprecated":false,"digest":{"length":1664,"function_hash":"11724925184125819064344196389817592483"},"id":"ASB-A-503554165-78330327","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e87caba4b8dfdb826c1d4b7cbb8a192d31ce7e85","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"},"deprecated":false,"digest":{"line_hashes":["112373446171663809869640892700044938689","118917688269711103279799354748860035008","138058523224533762607675471789792265359","307630405767951864583931674205263119200","208155317813887102245563963008989563285","114811983039094628438859413554804319863","331807186545735884827352105396800808085","179784592781943990224755688927913883544","44794428931293768415444562445896552755","70752763005570436028786168213805771363","222965713880767479490121852352129223260","145688579517188459029427134524127377578","260349400304330259382744213044346081028","75739102308686404547069140805224666999","148149249591933987738877270520379118725","187326446204122394750906423536920348027","18023967186741516646884973433092084145","128994792291507184593194642354422667465","32087707219056433049869342162387490043","132982703881331234420883009959454590721","279170509792850770080381518966249198539","265586829114751495691861076629484508559","124742650738242512918519193356679738573","180880475039105403286396023424403160004","298623726518687204779881775531827294725","192836523542020636883385478555009092432","241024831239543635561609320795578441507","63023319149774050960125992398873200987","310568192335556860099790048577565682933"],"threshold":0.9},"id":"ASB-A-503554165-e581d3bd"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503554165.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-09-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fa95ffbb31eeb9eff4dfa1318a4f503d65b3732b","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"},"deprecated":false,"digest":{"line_hashes":["308816780056672039596414764039062193456","309223892947826543722540600602693433640","58659191746476790793202899776965703854","183275681066096025451777261374101096633","216695161596807557591873795869110715093","145698361171556500030788192761291644126","187609231002536059502007748554215019280","182602075338744585112105718613542638202","266725900234129417486082614476257090174","265306512510489736354051698007617828557","183541731127391317592899031334044255112","337030324200886748285543608716817982580","179784592781943990224755688927913883544","19178213491240358276713708448705011600","267774788116652082706295939806057543980","222965713880767479490121852352129223260","145688579517188459029427134524127377578","198052604672054376143224198012834977094","26796940221397657608399312853433149997","284122508446857831006519722044579584093","187326446204122394750906423536920348027","18023967186741516646884973433092084145","128994792291507184593194642354422667465","75442546376225858835932859662086938154","152407064014556496855314086660764890661","121702905086443873076930903835796365421","214480308593766222209601660056177199239","72934979116336358475700849108144069137","320370179011600833910871077454695159154","47220801757088905102391092920500596210","337316653778524130537684207906380524864","86240491715320185517829365967129243283","197494463814088336627407800758568112017","164820060521441480337942670299694831489","296341781001668297495381803555356229114","63023319149774050960125992398873200987","310568192335556860099790048577565682933"],"threshold":0.9},"id":"ASB-A-503554165-73d8cb03","signature_type":"Line"},{"id":"ASB-A-503554165-fdf2485f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fa95ffbb31eeb9eff4dfa1318a4f503d65b3732b","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc","function":"a2dp_vendor_opus_decoder_decode_packet"},"deprecated":false,"digest":{"length":1664,"function_hash":"11724925184125819064344196389817592483"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/fa95ffbb31eeb9eff4dfa1318a4f503d65b3732b"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503554165.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2854dae19ea705b8a94753baeb9f8f008d3b814c","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc","function":"a2dp_vendor_opus_decoder_decode_packet"},"deprecated":false,"digest":{"function_hash":"11724925184125819064344196389817592483","length":1664},"id":"ASB-A-503554165-bcc411d1","signature_type":"Function","signature_version":"v1"},{"target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"},"deprecated":false,"digest":{"line_hashes":["112373446171663809869640892700044938689","118917688269711103279799354748860035008","138058523224533762607675471789792265359","307630405767951864583931674205263119200","208155317813887102245563963008989563285","114811983039094628438859413554804319863","331807186545735884827352105396800808085","179784592781943990224755688927913883544","44794428931293768415444562445896552755","70752763005570436028786168213805771363","222965713880767479490121852352129223260","145688579517188459029427134524127377578","260349400304330259382744213044346081028","75739102308686404547069140805224666999","148149249591933987738877270520379118725","187326446204122394750906423536920348027","18023967186741516646884973433092084145","128994792291507184593194642354422667465","32087707219056433049869342162387490043","132982703881331234420883009959454590721","279170509792850770080381518966249198539","265586829114751495691861076629484508559","124742650738242512918519193356679738573","180880475039105403286396023424403160004","298623726518687204779881775531827294725","192836523542020636883385478555009092432","241024831239543635561609320795578441507","63023319149774050960125992398873200987","310568192335556860099790048577565682933"],"threshold":0.9},"id":"ASB-A-503554165-c26d545f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2854dae19ea705b8a94753baeb9f8f008d3b814c"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/2854dae19ea705b8a94753baeb9f8f008d3b814c"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503554165.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-09-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/733ed68aad584cfd0dcded036fd5f75f4f853faf"],"severity":"Critical","spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"11724925184125819064344196389817592483","length":1664},"id":"ASB-A-503554165-81f4a7c7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/733ed68aad584cfd0dcded036fd5f75f4f853faf","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc","function":"a2dp_vendor_opus_decoder_decode_packet"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/733ed68aad584cfd0dcded036fd5f75f4f853faf","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"},"deprecated":false,"digest":{"line_hashes":["112373446171663809869640892700044938689","118917688269711103279799354748860035008","138058523224533762607675471789792265359","307630405767951864583931674205263119200","208155317813887102245563963008989563285","114811983039094628438859413554804319863","331807186545735884827352105396800808085","179784592781943990224755688927913883544","44794428931293768415444562445896552755","70752763005570436028786168213805771363","222965713880767479490121852352129223260","145688579517188459029427134524127377578","260349400304330259382744213044346081028","75739102308686404547069140805224666999","148149249591933987738877270520379118725","187326446204122394750906423536920348027","18023967186741516646884973433092084145","128994792291507184593194642354422667465","32087707219056433049869342162387490043","132982703881331234420883009959454590721","279170509792850770080381518966249198539","265586829114751495691861076629484508559","124742650738242512918519193356679738573","180880475039105403286396023424403160004","298623726518687204779881775531827294725","192836523542020636883385478555009092432","241024831239543635561609320795578441507","63023319149774050960125992398873200987","310568192335556860099790048577565682933"],"threshold":0.9},"id":"ASB-A-503554165-daf6d808","signature_type":"Line"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503554165.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-09-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["112373446171663809869640892700044938689","118917688269711103279799354748860035008","138058523224533762607675471789792265359","307630405767951864583931674205263119200","208155317813887102245563963008989563285","114811983039094628438859413554804319863","331807186545735884827352105396800808085","179784592781943990224755688927913883544","44794428931293768415444562445896552755","70752763005570436028786168213805771363","222965713880767479490121852352129223260","145688579517188459029427134524127377578","260349400304330259382744213044346081028","75739102308686404547069140805224666999","148149249591933987738877270520379118725","187326446204122394750906423536920348027","18023967186741516646884973433092084145","128994792291507184593194642354422667465","32087707219056433049869342162387490043","132982703881331234420883009959454590721","279170509792850770080381518966249198539","265586829114751495691861076629484508559","124742650738242512918519193356679738573","180880475039105403286396023424403160004","298623726518687204779881775531827294725","192836523542020636883385478555009092432","241024831239543635561609320795578441507","63023319149774050960125992398873200987","310568192335556860099790048577565682933"]},"id":"ASB-A-503554165-f24abe95","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/332d58ff7e067e90d1284d0bff4a3c1aad9ddd36","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/332d58ff7e067e90d1284d0bff4a3c1aad9ddd36","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc","function":"a2dp_vendor_opus_decoder_decode_packet"},"deprecated":false,"digest":{"length":1664,"function_hash":"11724925184125819064344196389817592483"},"id":"ASB-A-503554165-f2e55825","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/332d58ff7e067e90d1284d0bff4a3c1aad9ddd36"],"severity":"Critical","spl":"2026-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503554165.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2026-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b97933907b9230a21c24e3d6c0504bedc0b5d7d0","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc","function":"a2dp_vendor_opus_decoder_decode_packet"},"deprecated":false,"digest":{"length":1640,"function_hash":"212402463810844531308059378202135754699"},"id":"ASB-A-503554165-2e8cadcf","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["308816780056672039596414764039062193456","309223892947826543722540600602693433640","58659191746476790793202899776965703854","183275681066096025451777261374101096633","216695161596807557591873795869110715093","9456355801755336650136578021090603293","196884114308225482761676448296442713340","168654695613025805246815026095172185701","277329114828181365692550183877850336796","188483142884733522803133433848524686490","159555971795796961022376608170771154216","337030324200886748285543608716817982580","179784592781943990224755688927913883544","19178213491240358276713708448705011600","267774788116652082706295939806057543980","222965713880767479490121852352129223260","145688579517188459029427134524127377578","34844861341963283875652484457194954221","57933610495997720424324877907331194381","28941166270523148116607490789846068180","337463211721465115020182532796386083887","18023967186741516646884973433092084145","128994792291507184593194642354422667465","315290418088110752554347083553020671177","204239261213974384366500298162384042839","241553056156693339881432564717974428452","121107427244305916810812779401759248582","72934979116336358475700849108144069137","320370179011600833910871077454695159154","47220801757088905102391092920500596210","337316653778524130537684207906380524864","86240491715320185517829365967129243283","197494463814088336627407800758568112017","164820060521441480337942670299694831489","296341781001668297495381803555356229114","63023319149774050960125992398873200987","310568192335556860099790048577565682933"]},"id":"ASB-A-503554165-7486c5b8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b97933907b9230a21c24e3d6c0504bedc0b5d7d0","target":{"file":"system/stack/a2dp/a2dp_vendor_opus_decoder.cc"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b97933907b9230a21c24e3d6c0504bedc0b5d7d0"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-503554165.json"}}],"schema_version":"1.9.0"}