{"id":"ASB-A-522372274","details":"In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-522372274","CVE-2026-55269"],"modified":"2026-10-05T16:56:06.609669760Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"function":"TEST_F","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"function_hash":"246723683549866751493573909455343009703","length":2214},"id":"ASB-A-522372274-019cf37e"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["158200819445386134177936295702955735382","4139362980451998596924249030445462413","52700284085879716159314448886049812034","278176551384158374446664208198490782019","227727791413726504713210430863008135539","284360508867883407336331986827730315741","88834029904996324001096239099578427898","92705279026477912090603448568298029500","61980072477478349696857769595441058214","276457531786224781861024550526524829516","88834029904996324001096239099578427898","92705279026477912090603448568298029500","142383761567626123287593292611143670631","291546764864324326499317700349615109177","88834029904996324001096239099578427898","92705279026477912090603448568298029500"]},"id":"ASB-A-522372274-693d31b8"},{"digest":{"function_hash":"53881474740965101877136389325477858565","length":2368},"id":"ASB-A-522372274-76fbf901","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"function":"TEST_F","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"file":"system/gd/hal/snoop_logger.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["181266181211620693404888341813178027143","111315914176387887908060969285383578850","67711727113733261755631088289278506561","287227742371283328038254616982367975574","110032217682972160027158316572292798414","68986527579664712575049020536452280705","165560519134704901613096702864142530379","31726614903768848027254149897412693371"]},"id":"ASB-A-522372274-dd83c4cd","signature_type":"Line","signature_version":"v1"},{"target":{"file":"system/gd/hal/snoop_logger.cc","function":"SnoopLogger::FilterCapturedPacket"},"deprecated":false,"digest":{"function_hash":"154785654276675420321081737784626453063","length":1169},"id":"ASB-A-522372274-e6817602","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"function":"TEST_F","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"length":2308,"function_hash":"70655787517642236018642036569526023589"},"id":"ASB-A-522372274-e7840df4","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e"],"severity":"Critical","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522372274.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"Critical","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2","target":{"file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["158200819445386134177936295702955735382","159340739937812780364119428540289608176","143616464578955397402840977931471802203","270051686240950753391803267439821806406","243856159923083137177934890444295057046","37477872440081306302429574114126351682","10906170983236239424446484760233750396","128338104743417124645645249388208906869","96790392763558237854259834734548278251","253104428708453886646675825165333747950","10906170983236239424446484760233750396","128338104743417124645645249388208906869","41222755738157882998136448067610047202","66912489947180533097094676553911762320","10906170983236239424446484760233750396","128338104743417124645645249388208906869"]},"id":"ASB-A-522372274-0b4cd1de"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2","target":{"file":"system/gd/hal/snoop_logger.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["181266181211620693404888341813178027143","111315914176387887908060969285383578850","67711727113733261755631088289278506561","287227742371283328038254616982367975574","110032217682972160027158316572292798414","68986527579664712575049020536452280705","165560519134704901613096702864142530379","218934215270707795717059640916324652136"]},"id":"ASB-A-522372274-297fc37d","match_only_versions":["16"],"signature_type":"Line"},{"digest":{"function_hash":"272561556308199201574688824678322626068","length":2356},"id":"ASB-A-522372274-496dac9c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2","target":{"function":"TEST_F","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false},{"digest":{"length":2206,"function_hash":"56353602535859068876142244014369506990"},"id":"ASB-A-522372274-64f56a04","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2","target":{"function":"TEST_F","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false},{"deprecated":false,"digest":{"length":1169,"function_hash":"154785654276675420321081737784626453063"},"id":"ASB-A-522372274-86e0d577","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2","target":{"file":"system/gd/hal/snoop_logger.cc","function":"SnoopLogger::FilterCapturedPacket"}},{"target":{"function":"TEST_F","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"length":2296,"function_hash":"95097682103312222007963273808788505444"},"id":"ASB-A-522372274-d86876a5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0e7667da9b935ceb7dd627d2b9b67d7b9bd1bbf2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522372274.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f"],"severity":"Critical","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-522372274-00f918c2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f","target":{"file":"system/gd/hal/snoop_logger_test.cc","function":"TEST_P"},"deprecated":false,"digest":{"function_hash":"324712479278546019856595874635751708652","length":2339}},{"id":"ASB-A-522372274-33921bde","match_only_versions":["16-qpr2"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f","target":{"file":"system/gd/hal/snoop_logger.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["181266181211620693404888341813178027143","111315914176387887908060969285383578850","67711727113733261755631088289278506561","287227742371283328038254616982367975574","110032217682972160027158316572292798414","68986527579664712575049020536452280705","165560519134704901613096702864142530379","218934215270707795717059640916324652136"]}},{"id":"ASB-A-522372274-35171c01","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f","target":{"file":"system/gd/hal/snoop_logger_test.cc","function":"TEST_P"},"deprecated":false,"digest":{"function_hash":"67988436774633188839018039484509107849","length":2279}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f","target":{"function":"TEST_P","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"length":2185,"function_hash":"139365611964801789489041589329465866357"},"id":"ASB-A-522372274-73321647"},{"target":{"function":"SnoopLogger::FilterCapturedPacket","file":"system/gd/hal/snoop_logger.cc"},"deprecated":false,"digest":{"function_hash":"154785654276675420321081737784626453063","length":1169},"id":"ASB-A-522372274-73d6e2c1","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f"},{"id":"ASB-A-522372274-b3c35770","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/be1aa028f47192694e524ad4370d169b2d77e40f","target":{"file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"line_hashes":["158200819445386134177936295702955735382","159340739937812780364119428540289608176","226320844949627900547404198377861839510","137224853085218192034372402784443378162","144859298578910593299839899813533889769","275683301262758940741517646966636469166","115685458349649471316638526311136713507","135851685212389741440220350346353913076","134057159010788262199221789100292437519","121015403339208641216625176641607250510","115685458349649471316638526311136713507","135851685212389741440220350346353913076","34460787386938890624601772986775870578","261158253999439962320839955450714563160","115685458349649471316638526311136713507","135851685212389741440220350346353913076"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522372274.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405","target":{"file":"system/gd/hal/snoop_logger_test.cc","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"324712479278546019856595874635751708652","length":2339},"id":"ASB-A-522372274-50e64505","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["158200819445386134177936295702955735382","159340739937812780364119428540289608176","324084327174832942660876930286649249108","144720227613865487604087824177827442292","144859298578910593299839899813533889769","275683301262758940741517646966636469166","115685458349649471316638526311136713507","135851685212389741440220350346353913076","134057159010788262199221789100292437519","121015403339208641216625176641607250510","115685458349649471316638526311136713507","135851685212389741440220350346353913076","34460787386938890624601772986775870578","261158253999439962320839955450714563160","115685458349649471316638526311136713507","135851685212389741440220350346353913076"],"threshold":0.9},"id":"ASB-A-522372274-7245b09b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405","target":{"file":"system/gd/hal/snoop_logger_test.cc"}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405","target":{"function":"TEST_F","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"length":2185,"function_hash":"139365611964801789489041589329465866357"},"id":"ASB-A-522372274-8976281c","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405","target":{"function":"TEST_F","file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"length":2279,"function_hash":"67988436774633188839018039484509107849"},"id":"ASB-A-522372274-a253c174","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405","target":{"file":"system/gd/hal/snoop_logger.cc","function":"SnoopLogger::FilterCapturedPacket"},"deprecated":false,"digest":{"function_hash":"154785654276675420321081737784626453063","length":1169},"id":"ASB-A-522372274-b5704b9d","signature_type":"Function"},{"target":{"file":"system/gd/hal/snoop_logger.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["181266181211620693404888341813178027143","111315914176387887908060969285383578850","67711727113733261755631088289278506561","287227742371283328038254616982367975574","110032217682972160027158316572292798414","68986527579664712575049020536452280705","165560519134704901613096702864142530379","218934215270707795717059640916324652136"]},"id":"ASB-A-522372274-e89df3e3","match_only_versions":["17"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e97eb2859df35b4d9f99f8bddf490849a5883405"],"severity":"Critical","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522372274.json"}}],"schema_version":"1.9.0"}