Description
In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References (1)
Core 1
Core References
Scores
CVSS v3
8.0
EPSS
0.0011
EPSS Percentile
1.4%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-190
Status
published
Products (7)
google/android
14.0
google/android
15.0
google/android
16.0 (4 CPE variants)
Google/Android
14
Google/Android
15
Google/Android
16
Google/Android
16-qpr2
Published
Jun 01, 2026
Tracked Since
Jun 02, 2026