{"id":"ASB-A-522372651","details":"In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-522372651","CVE-2026-49933"],"modified":"2026-10-05T16:56:07.108790723Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"Critical","spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"target":{"file":"system/gd/hal/snoop_logger_test.cc","function":"TEST_F"},"deprecated":false,"digest":{"length":2214,"function_hash":"246723683549866751493573909455343009703"},"id":"ASB-A-522372651-019cf37e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e"},{"id":"ASB-A-522372651-693d31b8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"file":"system/gd/hal/snoop_logger_test.cc"},"deprecated":false,"digest":{"line_hashes":["158200819445386134177936295702955735382","4139362980451998596924249030445462413","52700284085879716159314448886049812034","278176551384158374446664208198490782019","227727791413726504713210430863008135539","284360508867883407336331986827730315741","88834029904996324001096239099578427898","92705279026477912090603448568298029500","61980072477478349696857769595441058214","276457531786224781861024550526524829516","88834029904996324001096239099578427898","92705279026477912090603448568298029500","142383761567626123287593292611143670631","291546764864324326499317700349615109177","88834029904996324001096239099578427898","92705279026477912090603448568298029500"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"file":"system/gd/hal/snoop_logger_test.cc","function":"TEST_F"},"deprecated":false,"digest":{"length":2368,"function_hash":"53881474740965101877136389325477858565"},"id":"ASB-A-522372651-76fbf901","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"file":"system/gd/hal/snoop_logger.cc"},"deprecated":false,"digest":{"line_hashes":["181266181211620693404888341813178027143","111315914176387887908060969285383578850","67711727113733261755631088289278506561","287227742371283328038254616982367975574","110032217682972160027158316572292798414","68986527579664712575049020536452280705","165560519134704901613096702864142530379","31726614903768848027254149897412693371"],"threshold":0.9},"id":"ASB-A-522372651-dd83c4cd","signature_type":"Line"},{"id":"ASB-A-522372651-e6817602","match_only_versions":["17-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"file":"system/gd/hal/snoop_logger.cc","function":"SnoopLogger::FilterCapturedPacket"},"deprecated":false,"digest":{"function_hash":"154785654276675420321081737784626453063","length":1169}},{"digest":{"function_hash":"70655787517642236018642036569526023589","length":2308},"id":"ASB-A-522372651-e7840df4","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e","target":{"file":"system/gd/hal/snoop_logger_test.cc","function":"TEST_F"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["76148413103271731899121825941573300569","66375027220060361123405057356097300075","149892852650925427595339894549322079331","10511902240766966384980360183965725151","44440862999974738080730458981300631505","102300321447880512662430744442178689537","3584694846551722812254284656324469761","94138012884016884353096924181526005838","216281551480449218498985854457346893077","67676619318514079711580523900808032889","215522082758937699142158417557752762867","90089676231714011040094763376295454293","158444981555462118554515511784046912300","104460502824404623589389106265416528581","146308764134443773681075912036504415125","250772105855515439493340680585963382939","129033694146773588137900648319427866633","138201933555372318523173626329560722811","2174671701754158878405658110462269965"],"threshold":0.9},"id":"ASB-A-522372651-f1a96f69","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6505b430477940ff61355726ca3142fdd06fb21","target":{"file":"system/gd/hci/msft.cc"}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/d6505b430477940ff61355726ca3142fdd06fb21","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0083751f4ce0a648674ee6e31b480bafa2e0e97e"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522372651.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2026-10-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/36c99237b7c142ed536a50437c4469458c305acc","target":{"file":"system/gd/hci/msft.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["76148413103271731899121825941573300569","256598125464686523305569038459809660227","192630044828646945181342389416891979310","164589143938894441424901564913156904063","197895003676535660363193259082123176920","47925032755260285592581900767676206506","171327422406183257184268499742856432070","195611227293247267492451700308760093373","77710769524471846873364039802291505844","215522082758937699142158417557752762867","90089676231714011040094763376295454293","158444981555462118554515511784046912300","104460502824404623589389106265416528581","146308764134443773681075912036504415125","307122447648904190709326264868412609920","154380142658042416597917576875991075003","58082490710001401943556762643069144757","32894523238146086077765680443884859145"]},"id":"ASB-A-522372651-c9e0236f","match_only_versions":["16"],"signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/36c99237b7c142ed536a50437c4469458c305acc"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522372651.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"id":"ASB-A-522372651-beb64a4c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0099192812a2d453f61994f26acd0b906105066b","target":{"file":"system/gd/hci/msft.cc"},"deprecated":false,"digest":{"line_hashes":["76148413103271731899121825941573300569","256598125464686523305569038459809660227","192630044828646945181342389416891979310","164589143938894441424901564913156904063","197895003676535660363193259082123176920","47925032755260285592581900767676206506","171327422406183257184268499742856432070","195611227293247267492451700308760093373","77710769524471846873364039802291505844","215522082758937699142158417557752762867","90089676231714011040094763376295454293","158444981555462118554515511784046912300","104460502824404623589389106265416528581","146308764134443773681075912036504415125","307122447648904190709326264868412609920","154380142658042416597917576875991075003","109025424290103957676336107121222133635","2174671701754158878405658110462269965"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0099192812a2d453f61994f26acd0b906105066b"],"severity":"Critical","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522372651.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-522372651-8ca0e145","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec040a5dfc7e10cb92277191891b22e26548a0a4","target":{"file":"system/gd/hci/msft.cc"},"deprecated":false,"digest":{"line_hashes":["76148413103271731899121825941573300569","256598125464686523305569038459809660227","192630044828646945181342389416891979310","164589143938894441424901564913156904063","197895003676535660363193259082123176920","47925032755260285592581900767676206506","171327422406183257184268499742856432070","195611227293247267492451700308760093373","77710769524471846873364039802291505844","215522082758937699142158417557752762867","90089676231714011040094763376295454293","158444981555462118554515511784046912300","104460502824404623589389106265416528581","146308764134443773681075912036504415125","250772105855515439493340680585963382939","129033694146773588137900648319427866633","138201933555372318523173626329560722811","2174671701754158878405658110462269965"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ec040a5dfc7e10cb92277191891b22e26548a0a4"],"severity":"Critical","spl":"2026-10-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522372651.json"}}],"schema_version":"1.9.0"}