In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Thu, 12 Nov 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Local Privilege Escalation via Buffer Underflow in Android's Bluetooth Stack | |
| Weaknesses | CWE-787 |
Thu, 12 Nov 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-119 | |
| Metrics |
cvssV3_1
|
Thu, 12 Nov 2026 05:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Local Privilege Escalation via Buffer Underflow in Android's Bluetooth Stack | |
| Weaknesses | CWE-787 |
Tue, 10 Nov 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Google_Devices
Published: 2026-11-10T19:22:48.226Z
Updated: 2026-11-12T20:45:25.687Z
Reserved: 2026-09-22T05:59:06.219Z
Link: CVE-2026-95405
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-10T20:19:48.643
Modified: 2026-11-12T21:17:33.553
Link: CVE-2026-95405
Redhat
No data.