● Android Bulletin · April 2026

Android Security Bulletin: April 2026 Bluetooth HCI Heap Triage

Technical triage of Android's April 2026 release addressing zero-click Bluetooth HCI fragmentation heap buffer overflows.

42
CVEs Resolved
1
Zero-Click Bluetooth RCE
8.8
CVSS Bluetooth
Critical
Wireless Patch Urgency

Triaje Ejecutivo y Veredicto de Riesgo

The April 2026 release resolves CVE-2024-0044 in the Fluoride Bluetooth stack. An unchecked HCI packet fragment length caused heap corruption, allowing adjacent attackers within Bluetooth range to execute arbitrary code.

Matriz Curada de Triaje de Vulnerabilidades

Identificador CVE Subsistema / Componente Impacto CVSS ¿Explotación Activa?
CVE-2024-0044Fluoride Bluetooth StackHeap Buffer Overflow / RCE8.8 HighYES (In-The-Wild)
CVE-2024-0045Android Wi-Fi ServiceInformation Disclosure6.5 MediumNo
CVE-2024-0046Sensors HALDenial of Service5.1 MediumNo
ANÁLISIS DE CÓDIGO DESTACADO

Deep Dive: Android Bluetooth HCI Heap Buffer Overflow Teardown →

Inspect the C commit in system/bt/stack/l2cap showing packet length assertion checks during ACL fragment reassembly.

← Explorar Directorio de Seguridad Todas las Actualizaciones de Seguridad →