CVE-2025-0079: Bluetooth Package Unencrypted Channel Vulnerability
Summary
CVE-2025-0079: In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. Affects platform/system/bt across 2 version ranges.
>= 12:0, < 12:2025-03-01
>= 12L:0, < 12L:2025-03-01
Fixed in 12:2025-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected packages, 'platform/system/bt' and 'platform/packages/modules/Bluetooth', are integral components of the Android operating system, facilitating Bluetooth communication between devices. These packages manage the protocols and channels necessary for Bluetooth connectivity, ensuring secure data transmission. However, a logic error in the code has led to potential unencrypted channels, posing a significant security risk.
Vulnerability Detail
In multiple locations within the Bluetooth packages, a logic error could allow avdtp and avctp channels to remain unencrypted. This vulnerability can lead to local escalation of privilege, requiring user execution privileges for exploitation. Notably, user interaction is not necessary for an attacker to exploit this flaw, making it a critical security concern for devices utilizing these Bluetooth functionalities.
How To Fix
Minimum fixed version
12:2025-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The CVE-2025-0079 vulnerability presents a significant risk to Android Bluetooth packages, allowing for unencrypted communication channels due to a logic error. Users are strongly advised to update their packages to the latest patched versions to ensure their devices remain secure.
See every vulnerability recorded for platform/system/bt →
FAQ
CVE-2025-0079 is a vulnerability in the Android Bluetooth packages that could allow unencrypted communication channels due to a logic error in the code.
The vulnerability could lead to local escalation of privilege, allowing unauthorized access to sensitive data transmitted over Bluetooth channels.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize updating your packages to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/system/bt.
