{"id":"ASB-A-522373105","details":"In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-522373105","CVE-2026-58880"],"modified":"2026-10-05T16:41:14.708348511Z","published":"2026-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-10-01"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-10-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"Critical","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2","target":{"file":"system/include/hardware/bt_rc.h"},"deprecated":false,"digest":{"line_hashes":["92349898900628523434251924885245726404","132821318000631733850894742557044440786","131226620104169995491696136052815213244","152316497097907199971804673235854758854","163450094143265197203783736975098988223","54290254466645111406076916591093223932"],"threshold":0.9},"id":"ASB-A-522373105-31a3dc34"},{"id":"ASB-A-522373105-4ffb42f9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2","target":{"function":"handle_app_attr_txt_response","file":"system/btif/src/btif_rc.cc"},"deprecated":false,"digest":{"length":1743,"function_hash":"7000326074605733845825547348180708226"}},{"id":"ASB-A-522373105-62e8876c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2","target":{"file":"system/btif/src/btif_rc.cc","function":"handle_app_attr_val_txt_response"},"deprecated":false,"digest":{"length":2819,"function_hash":"93999680276979206708495460895296181727"}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2","target":{"file":"system/btif/src/btif_rc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["31907738530266004767223499180471078385","42509700709624815341762306891845359557","187629592039708894437388644035483977944","109304125008990616954655207580194774798","33262424147565392208598365308188416223","55592945859636309625759281069354282052","262895922717953683162185094190667071577","56272265255711785308652072750742032215","33262424147565392208598365308188416223","55592945859636309625759281069354282052","262895922717953683162185094190667071577","56272265255711785308652072750742032215","143760596620956287193256397099551781642","80952588686057987194869544417008441092","40245853989966781629761310332584393389","258633672919697322510258450771527830850","59238394010665217226517265210623419016","271060784739236877148115541743645247715","312347054038796015635200793346867397188"]},"id":"ASB-A-522373105-8b1de00a","signature_type":"Line","signature_version":"v1"},{"id":"ASB-A-522373105-9001b90a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2","target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["71852894101241296351986038488947516987","245790275767766707221805364666164341607","303941405824397751575163828883658314345","213023372752609448292967345469032127102","25849902745112574827078966910214551476","304699192025357276231264465245632074962"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2","target":{"function":"handle_app_val_response","file":"system/btif/src/btif_rc.cc"},"deprecated":false,"digest":{"function_hash":"265056820738958798688822881799169412394","length":1788},"id":"ASB-A-522373105-a45900d7"},{"id":"ASB-A-522373105-a5d178bf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2","target":{"function":"btavrcp_playerapplicationsetting_callback","file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"},"deprecated":false,"digest":{"function_hash":"44511156494072803426444069525447064405","length":1269}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/3e7ec1e85fec621d002be68a6156bc338a9177c2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522373105.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-10-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"Critical","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2","target":{"file":"system/btif/src/btif_rc.cc","function":"handle_app_attr_txt_response"},"deprecated":false,"digest":{"function_hash":"53111948554782607706693951782171642594","length":1641},"id":"ASB-A-522373105-0346edc6","match_only_versions":["16"],"signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2","target":{"file":"system/btif/src/btif_rc.cc","function":"handle_app_val_response"},"deprecated":false,"digest":{"function_hash":"52059334469655989935411864956475233983","length":1806},"id":"ASB-A-522373105-09ba1b50","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":1493,"function_hash":"227900733609995822892809556835104348614"},"id":"ASB-A-522373105-702d6c9b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2","target":{"function":"btavrcp_playerapplicationsetting_callback","file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2","target":{"file":"system/btif/src/btif_rc.cc"},"deprecated":false,"digest":{"line_hashes":["306367619304702991884474815182280904801","203140059624735935127373299724905299619","309741182714389662418744654070236891838","274238053738644898391094386936505014474","76470796739631368161751004399827973931","251635554509996764564635671514405603330","225894735984986322904652040307173036598","181167244862971031225029647920243855208","76470796739631368161751004399827973931","251635554509996764564635671514405603330","225894735984986322904652040307173036598","181167244862971031225029647920243855208","140137449322196489207238102413967604118","24418801201892551135042383862867891897","317639409410531128743641614893155015114","88892102447301918159282320469073287072","87231120130862032198052599156935372425","271060784739236877148115541743645247715","312347054038796015635200793346867397188"],"threshold":0.9},"id":"ASB-A-522373105-7284e41f"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2","target":{"file":"system/btif/src/btif_rc.cc","function":"handle_app_attr_val_txt_response"},"deprecated":false,"digest":{"length":2738,"function_hash":"147667104775851454251568745577943895118"},"id":"ASB-A-522373105-810a48f7"},{"digest":{"line_hashes":["92349898900628523434251924885245726404","132821318000631733850894742557044440786","131226620104169995491696136052815213244","152316497097907199971804673235854758854","163450094143265197203783736975098988223","54290254466645111406076916591093223932"],"threshold":0.9},"id":"ASB-A-522373105-ea4790bd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2","target":{"file":"system/include/hardware/bt_rc.h"},"deprecated":false},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2","target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"},"deprecated":false,"digest":{"line_hashes":["71852894101241296351986038488947516987","245790275767766707221805364666164341607","303941405824397751575163828883658314345","213023372752609448292967345469032127102","25849902745112574827078966910214551476","304699192025357276231264465245632074962"],"threshold":0.9},"id":"ASB-A-522373105-face89bd","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/bacc6af1f60c68730c436aa5eb4bbeb3771acda2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522373105.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-10-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e"],"severity":"Critical","spl":"2026-10-01","types":["EoP"],"vanir_signatures":[{"target":{"function":"handle_app_attr_txt_response","file":"system/btif/src/btif_rc.cc"},"deprecated":false,"digest":{"function_hash":"53111948554782607706693951782171642594","length":1641},"id":"ASB-A-522373105-4f4dfdde","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e","target":{"file":"system/btif/src/btif_rc.cc","function":"handle_app_attr_val_txt_response"},"deprecated":false,"digest":{"function_hash":"147667104775851454251568745577943895118","length":2738},"id":"ASB-A-522373105-90547b28","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e","target":{"file":"system/include/hardware/bt_rc.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["92349898900628523434251924885245726404","132821318000631733850894742557044440786","131226620104169995491696136052815213244","152316497097907199971804673235854758854","163450094143265197203783736975098988223","54290254466645111406076916591093223932"]},"id":"ASB-A-522373105-96d254c6"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e","target":{"file":"system/btif/src/btif_rc.cc"},"deprecated":false,"digest":{"line_hashes":["306367619304702991884474815182280904801","203140059624735935127373299724905299619","309741182714389662418744654070236891838","274238053738644898391094386936505014474","76470796739631368161751004399827973931","251635554509996764564635671514405603330","225894735984986322904652040307173036598","181167244862971031225029647920243855208","76470796739631368161751004399827973931","251635554509996764564635671514405603330","225894735984986322904652040307173036598","181167244862971031225029647920243855208","140137449322196489207238102413967604118","24418801201892551135042383862867891897","317639409410531128743641614893155015114","88892102447301918159282320469073287072","87231120130862032198052599156935372425","271060784739236877148115541743645247715","312347054038796015635200793346867397188"],"threshold":0.9},"id":"ASB-A-522373105-a2a9b512"},{"digest":{"line_hashes":["71852894101241296351986038488947516987","245790275767766707221805364666164341607","303941405824397751575163828883658314345","213023372752609448292967345469032127102","25849902745112574827078966910214551476","304699192025357276231264465245632074962"],"threshold":0.9},"id":"ASB-A-522373105-d2b00e6c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e","target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e","target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp","function":"btavrcp_playerapplicationsetting_callback"},"deprecated":false,"digest":{"length":1508,"function_hash":"215140233181415166424540646329338171858"},"id":"ASB-A-522373105-db71bac7","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/62bb443eb5cefba82790a6ab080db03889d8bc3e","target":{"file":"system/btif/src/btif_rc.cc","function":"handle_app_val_response"},"deprecated":false,"digest":{"function_hash":"52059334469655989935411864956475233983","length":1806},"id":"ASB-A-522373105-fe605c16","match_only_versions":["16-qpr2"],"signature_type":"Function","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522373105.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-10-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["92349898900628523434251924885245726404","132821318000631733850894742557044440786","131226620104169995491696136052815213244","152316497097907199971804673235854758854","163450094143265197203783736975098988223","54290254466645111406076916591093223932"]},"id":"ASB-A-522373105-1dcea58f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2","target":{"file":"system/include/hardware/bt_rc.h"}},{"target":{"function":"handle_app_attr_txt_response","file":"system/btif/src/btif_rc.cc"},"deprecated":false,"digest":{"function_hash":"28690532868144863262195843228350752810","length":1620},"id":"ASB-A-522373105-1ff1b852","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2","target":{"file":"system/btif/src/btif_rc.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["94705217822802792880050304455477950891","332988480452181712278670145465443416508","321214346419254076731542669103180338615","109304125008990616954655207580194774798","113953626761456538609130337235615086627","203321376258664323151842714421928331192","325293239017189394284368021717764616407","56272265255711785308652072750742032215","113953626761456538609130337235615086627","203321376258664323151842714421928331192","325293239017189394284368021717764616407","56272265255711785308652072750742032215","218877437539500692202352836435212166282","113839794097897826081218158153118106690","85521260511569383279676910488384503714","258633672919697322510258450771527830850","59238394010665217226517265210623419016","271060784739236877148115541743645247715","312347054038796015635200793346867397188"]},"id":"ASB-A-522373105-4c662e8e","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2","target":{"file":"system/btif/src/btif_rc.cc","function":"handle_app_val_response"},"deprecated":false,"digest":{"length":1785,"function_hash":"137948342842671820732905788622141982188"},"id":"ASB-A-522373105-7e961765"},{"id":"ASB-A-522373105-90ae946e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2","target":{"file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"},"deprecated":false,"digest":{"line_hashes":["71852894101241296351986038488947516987","245790275767766707221805364666164341607","303941405824397751575163828883658314345","213023372752609448292967345469032127102","25849902745112574827078966910214551476","304699192025357276231264465245632074962"],"threshold":0.9}},{"deprecated":false,"digest":{"length":2696,"function_hash":"333214778591261047789018205870651766285"},"id":"ASB-A-522373105-d407fc0b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2","target":{"function":"handle_app_attr_val_txt_response","file":"system/btif/src/btif_rc.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2","target":{"function":"btavrcp_playerapplicationsetting_callback","file":"android/app/jni/com_android_bluetooth_avrcp_controller.cpp"},"deprecated":false,"digest":{"length":1269,"function_hash":"44511156494072803426444069525447064405"},"id":"ASB-A-522373105-d95c70e0"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/96948f9b241db038184b92518bb072ac17d85af2"],"severity":"Critical","spl":"2026-10-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-522373105.json"}}],"schema_version":"1.9.0"}