Android Bluetooth CVE-2026-0095

Attacker must be within Bluetooth adjacent-network range of the target device (CVSS AV:A - not reachable over the internet or Wi-Fi LAN) and must already possess low-level privileges equivalent to a normal Android app holding Bluetooth permissions (PR:L), specifically the ability to send or influence L2CAP traffic to the victim's Bluetooth stack. The vulnerable code path is l2c_fcr_clone_buf, which is exercised when L2CAP Flow Control and Retransmission Mode (or Enhanced Retransmission Mode) is negotiated on a channel, so the target must have an active or accepting L2CAP connection using FCR/ERM. No user interaction is required (UI:N). Exploitation is limited to Android 14, 15, 16, and 16-qpr2 devices that have not yet applied the 2026-06-01 security patch level.

The CVSS 8.0 score (AV:A/AC:L/PR:L/UI:N/C:H/I:H/A:H) reflects high impact but realistic constraints - exploitation requires adjacent network access (Bluetooth radio range) and some level of existing privilege (PR:L), which on Android typically maps to a malicious or compromised app holding Bluetooth permissions. SSVC corroborates this nuanced picture: technical impact is 'total' but exploitation status is 'none' and 'automatable: no', indicating no observed in-the-wild use and no trivial mass-exploitation path. The vulnerability is not on the CISA KEV list and no public exploit identified at time of analysis, so this is best treated as a serious latent issue (heap corruption in a privileged process is a strong primitive for sandbox escape) rather than an imminent emergency. One conflict to note: the description says 'no additional execution privileges needed' while CVSS encodes PR:L - the most consistent reading is that the attacker needs the baseline Bluetooth permission a normal app already has, not elevated privileges beyond that.

A malicious Android app holding the standard Bluetooth runtime permission, or an attacker within Bluetooth radio range of an already-paired device, sends crafted L2CAP frames that trigger the integer overflow in l2c_fcr_clone_buf during buffer cloning. The resulting heap corruption inside the privileged Bluetooth process is then shaped into arbitrary code execution at the Bluetooth UID, escaping the app sandbox and giving the attacker access to call logs, contacts, paired-device data, and a foothold for further privilege escalation. No public exploit has been identified at time of analysis.