Android Bluetooth EUVD-2026-73997

Exploitation requires local access to the Android device and at least low-level app privileges (PR:L) - a standard installed application. No user interaction is required once the malicious app is running. The Bluetooth A2DP Opus codec must be active, meaning Bluetooth audio streaming via the Opus vendor extension must be in use or triggerable by the attacker app. This limits exploitation to scenarios where: (1) the attacker has installed an app on the device, and (2) can cause the Bluetooth stack to invoke the Opus decoder with attacker-controlled data. Exploitation is constrained by heap exploitation difficulty on hardened Android builds (ASLR, heap metadata integrity checks), explaining the SSVC Automatable: no rating. Remote network exploitation is not possible - the attack surface is purely local.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the attack as local, low-complexity, low-privilege with full CIA impact - consistent with a privilege escalation from app sandbox to Bluetooth service context. EPSS at 0.14% (4th percentile) indicates very low near-term exploitation probability in the wild, corroborated by SSVC Exploitation: none. However, SSVC Technical Impact is rated 'total', reflecting that successful exploitation yields full C/I/A compromise within the device's Bluetooth subsystem. The Automatable: no designation means mass exploitation is not feasible - each attack requires local access and specific Bluetooth audio interactions. No KEV listing and no public POC further reduce urgency for most defenders. Despite the broad affected version range (Android 14-17), the local-only attack surface and low EPSS score suggest this is a medium-priority patch item rather than an emergency response trigger for most enterprises.

A malicious Android application with low-level Bluetooth or audio permissions crafts a sequence of malformed Opus-encoded audio frames and routes them through the local Bluetooth A2DP pipeline. When the system's Bluetooth service decodes the frames via a2dp_vendor_opus_decoder_decode_packet, the oversized payload overwrites adjacent heap memory, enabling the attacker to redirect code execution within the Bluetooth service process and gain elevated privileges. No public proof-of-concept has been identified, and exploiting heap overflows reliably requires overcoming ASLR/heap hardening mitigations present in modern Android.