CVE-2025-26438: Bluetooth Module Vulnerability Leading to Remote Privilege Escalation
Summary
CVE-2025-26438: In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a protocol. Affects platform/packages/modules/Bluetooth across 4 version ranges.
>= 13:0, < 13:2025-05-01
>= 14:0, < 14:2025-05-01
>= 15:0, < 15:2025-05-01
>= 15-next:0, < 15-next:2025-05-01
Fixed in 15-next:2025-05-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth module in the Android ecosystem is responsible for enabling wireless communication between devices. It facilitates various functionalities such as file sharing, audio streaming, and device pairing. However, the module has been found to have a critical vulnerability that can be exploited to bypass Secure Simple Pairing (SMP) authentication, potentially allowing unauthorized access to sensitive operations.
Vulnerability Detail
In the function smp_process_secure_connection_oob_data of smp_act.cc, there exists a flaw in the implementation of the SMP protocol. This flaw allows attackers to bypass authentication mechanisms, leading to remote escalation of privileges without requiring any additional execution privileges. The vulnerability is classified as high severity and can be exploited without user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
15-next:2025-05-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as it becomes available.
Conclusion
The Bluetooth module vulnerability identified as CVE-2025-26438 poses a significant risk due to its ability to allow remote privilege escalation without user interaction. It is crucial for users to update their systems to the patched versions to safeguard against potential exploitation.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
CVE-2025-26438 is a vulnerability in the Bluetooth module of the Android ecosystem that allows attackers to bypass authentication and escalate privileges remotely.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If your application is affected, you should update the Bluetooth module to the patched version as soon as possible to mitigate the risk.
No, user interaction is not needed for exploitation, making this vulnerability particularly severe.
The vulnerability could lead to unauthorized access and control over Bluetooth functionalities, potentially compromising sensitive data and operations.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
