EUVD-2026-81323
GHSA-7gh6-gjx3-mf8w
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Over-the-air Bluetooth channel map gives AV:A/PR:N/UI:N; controller crash propagating to host justifies S:C; transient DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (qualcomm).
CVSS VectorVendor: qualcomm
Lifecycle Timeline
4DescriptionCVE.org
Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
AnalysisAI
Bluetooth denial of service in Qualcomm Snapdragon firmware allows an attacker within Bluetooth radio range (adjacent network, CVSS 7.4, AV:A/AC:L/PR:N/UI:N, S:C) to trigger a transient crash of the Bluetooth subsystem by supplying a crafted channel map that declares an insufficient number of used channels while adaptive frequency hopping (AFH) is fully enabled on the target. The impact is availability-only (C:N/I:N/A:H) and lasts only while the device is processing the malformed channel map; no confidentiality, integrity, code-execution, or authentication preconditions are present in the assessed vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be within Bluetooth radio range (adjacent network, AV:A) of a Snapdragon device and to supply a crafted Bluetooth channel map during connection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a Bluetooth Low Energy denial-of-service issue in Qualcomm Snapdragon firmware. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch availability is governed by the Qualcomm September 2026 security bulletin (https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2026-bulletin.html); the input data does not specify an exact patched firmware version, so treat the bulletin's Snapdragon firmware release as the primary fix and confirm the corrected build with the device OEM, since Qualcomm supplies the firmware but phone, laptop, automotive, and IoT vendors must ship it to end devices. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm the unauthenticated, adjacent-network nature of the flaw (CVSS AV:A/PR:N) and generate a complete inventory of Snapdragon-based assets - handsets, tablets, laptops, IoT endpoints, and any telematics or in-vehicle units - mapped to their OEM (Samsung, Google, Lenovo, Motorola, automotive Tier-1s, etc.); open a tracking case against the Qualcomm September 2026 bulletin and register for OEM security notifications so a firmware fix can be actioned the moment it is published. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware
CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.
Heap OOB write in Android Bluetooth driver via incorrect bounds check.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an att
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may
A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the ker
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attac
A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data poi
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into usersp
Use-after-free in the Linux kernel Bluetooth L2CAP stack lets a Bluetooth-adjacent attacker corrupt kernel memory by rac
Kernel crashes with a NULL-pointer dereference in the Linux kernel's Bluetooth L2CAP socket layer when l2cap_sock_cleanu
Local users on Linux hosts running the kernel Bluetooth stack (CONFIG_BT) can crash the system by racing an hci_conn tea
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today