EUVD-2026-93786
GHSA-xfrr-6jr6-gwjr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bluetooth CCC handler implies radio-proximity delivery (AV:A, not AV:N); no auth or interaction needed (PR:N/UI:N), and UAF-driven RCE gives full C/I/A impact.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
6DescriptionCVE.org
In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
AnalysisAI
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an attacker within Bluetooth radio range execute arbitrary code on unpatched Android devices, with no user interaction and no additional execution privileges required. The flaw is rated CVSS 9.8 under the vendor's AV:N vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); our independent assessment re-scores it AV:A because exploitation realistically requires the device's Bluetooth to be enabled and the attacker to be within radio range to deliver crafted CCC/GATT traffic, while agreeing that no authentication or victim action limits the attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the device's Bluetooth to be active and reachable by the attacker; the vulnerable path is the BluetoothCccHandlerCallbackImpl in the Bluetooth stack, so the attacker must be able to deliver crafted Bluetooth (CCC/GATT) traffic to the target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority flaw by impact: CWE-416 use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc) yielding remote code execution, with the input CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) and SSVC Technical Impact 'total' and Automatable 'yes' reinforcing worst-case severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: patch available per vendor advisory - apply the Android security patch level published in the Google Pixel/Android bulletin dated 2026-10-01 (https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01), which is the only vendor-released fix identified in the available data; no specific component version string is provided in the references, so verify the reported build date rather than assuming a version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, use the MDM/EMM console to push a policy that disables Bluetooth on all Android and Pixel devices where it is not operationally required, and publish a user advisory telling staff to turn Bluetooth off unless actively in use; simultaneously run a fleet inventory to identify which Android devices are running builds below the 2026-10-01 Android/Pixel security bulletin level referenced in the vendor context. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today