Android Bluetooth EUVD-2026-92613

Exploitation requires the Bluetooth subsystem to process attacker-influenced bonded/stored device configuration data through cfg2prop in btif_storage.cc, which converts stored config entries into Bluetooth properties; a crafted entry triggers the heap overflow. Practically this requires Bluetooth to be enabled and the attacker to be able to introduce malicious config/device data - in the Android Bluetooth context this generally implies radio proximity (an adjacent, paired, or spoofed Bluetooth device) rather than arbitrary internet-based access, despite the AV:N rating. Limiting factors: the flaw affects only Android 16, 16-qpr2, and 17; PR:L indicates some component-level privilege/pairing context is involved; and no user interaction is needed (UI:N), which raises risk once proximity is achieved.

Signals are mostly aligned toward a serious-but-not-yet-urgent memory-corruption flaw. The vendor CVSS (8.8, AV:N/AC:L/PR:L/UI:N) and SSVC 'Technical Impact: total' both indicate full compromise (C:H/I:H/A:H, RCE), and CWE-122 heap overflow in the Bluetooth btif_storage config parser is a classic RCE primitive. However, the exploitation-side signals are weak: SSVC reports Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, no EPSS score was provided, and no public exploit was identified - so this is a high-severity issue without evidence of real-world weaponization. Two data tensions should be flagged explicitly: (1) the CVSS vector claims AV:N (network) but the vulnerable code (cfg2prop in btif_storage.cc) is part of the Android Bluetooth stack, which in practice typically requires radio proximity (adjacent), so the true attack vector may be AV:A rather than AV:N - verify against the Android bulletin; (2) the description states 'no additional execution privileges needed' yet the vector is PR:L, reflecting Android's convention that no privilege escalation beyond the Bluetooth component is needed, not that exploitation is fully unauthenticated. Net: a credible RCE worth patching on cadence, but no current data supports treating it as an actively exploited emergency.

An attacker within Bluetooth range of a target Android 16/17 device supplies crafted bonded-device configuration data that is processed by cfg2prop when converting stored config into Bluetooth properties, triggering a heap buffer overflow and out-of-bounds write. Because user interaction is not required (UI:N) and the technical impact is total, successful exploitation can yield remote code execution within the Bluetooth stack context. No public exploit or active exploitation has been identified at the time of analysis.