CVE-2024-43766: Bluetooth Module in Android Exposes Unencrypted Communication
Summary
CVE-2024-43766: In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling. Affects platform/packages/modules/Bluetooth across 4 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth module in Android is a critical component that facilitates wireless communication between devices. It enables functionalities such as file sharing, audio streaming, and device pairing. This module is widely used across various Android devices, making its security paramount. The vulnerability in question arises from improper error handling in the Bluetooth stack, specifically in the btm_ble_sec.cc file, which can lead to unencrypted communication.
Vulnerability Detail
The vulnerability identified as CVE-2024-43766 exists in multiple functions of the btm_ble_sec.cc file within the Android Bluetooth module. It stems from inadequate error handling, which may allow unencrypted communication between devices. This flaw can lead to remote information disclosure without requiring additional execution privileges or user interaction, posing a significant risk to user data and privacy.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable Bluetooth on their devices until the patch is applied. This can be done by going to the device settings, selecting 'Bluetooth,' and toggling it off. Additionally, users can limit Bluetooth visibility to prevent unauthorized access.
Conclusion
In summary, CVE-2024-43766 is a significant vulnerability in the Android Bluetooth module that can lead to unencrypted communication and potential data exposure. Users are urged to update their devices to the latest patched version to safeguard against this risk. Temporary workarounds are available, but the best course of action is to apply the fix as soon as possible.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
CVE-2024-43766 is a vulnerability in the Android Bluetooth module that allows for potential unencrypted communication due to improper error handling.
This vulnerability can lead to remote information disclosure, potentially exposing sensitive data without user interaction.
Devices running affected versions of the Android Bluetooth module are at risk. It's recommended to check for updates and apply patches.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, disable Bluetooth on your device to mitigate the risk until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
