● Android Bulletin · April 2026

Android Security Bulletin: April 2026 Bluetooth HCI Heap Triage

Technical triage of Android's April 2026 release addressing zero-click Bluetooth HCI fragmentation heap buffer overflows.

42
CVEs Resolved
1
Zero-Click Bluetooth RCE
8.8
CVSS Bluetooth
Critical
Wireless Patch Urgency

Executive Triage und Risikobewertung

The April 2026 release resolves CVE-2024-0044 in the Fluoride Bluetooth stack. An unchecked HCI packet fragment length caused heap corruption, allowing adjacent attackers within Bluetooth range to execute arbitrary code.

Kuratierte Schwachstellen-Triage-Matrix

CVE-Kennung Subsystem / Komponente Auswirkung CVSS Aktive Ausnutzung?
CVE-2024-0044Fluoride Bluetooth StackHeap Buffer Overflow / RCE8.8 HighYES (In-The-Wild)
CVE-2024-0045Android Wi-Fi ServiceInformation Disclosure6.5 MediumNo
CVE-2024-0046Sensors HALDenial of Service5.1 MediumNo
HERVORGEHOBENE CODE-ANALYSE

Deep Dive: Android Bluetooth HCI Heap Buffer Overflow Teardown →

Inspect the C commit in system/bt/stack/l2cap showing packet length assertion checks during ACL fragment reassembly.

← Sicherheitsverzeichnis durchsuchen Alle Sicherheitsupdates →