CVE-2026-0095: Bluetooth Module Heap Corruption Vulnerability
Summary
CVE-2026-0095: In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow. Affects platform/packages/modules/Bluetooth across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Bluetooth module in the Android ecosystem is responsible for managing Bluetooth communications and functionalities across devices. It plays a crucial role in enabling wireless connections for data transfer, audio streaming, and device pairing. However, this module has been found to be vulnerable to a heap corruption issue due to an integer overflow, which can lead to serious security implications.
Vulnerability Detail
In the l2c_fcr_clone_buf function of l2c_fcr.cc, an integer overflow can be triggered, leading to controlled heap corruption within the privileged Bluetooth process. This vulnerability allows for local escalation of privilege without requiring additional execution privileges. Exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to apply the patches as soon as they are available.
Conclusion
The CVE-2026-0095 vulnerability in the Android Bluetooth module poses a significant risk due to its potential for local privilege escalation through heap corruption. Immediate action is required to update the affected packages to their patched versions to ensure device security.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
CVE-2026-0095 is a vulnerability in the Bluetooth module of Android that allows for heap corruption due to an integer overflow, potentially leading to local privilege escalation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could allow an attacker to escalate privileges locally, potentially compromising the security of the device.
No, user interaction is not needed for exploitation, making it more critical.
While there are no specific workarounds, it is crucial to prioritize applying the patches as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
