● Android Bulletin · April 2026

Android Security Bulletin: April 2026 Bluetooth HCI Heap Triage

Technical triage of Android's April 2026 release addressing zero-click Bluetooth HCI fragmentation heap buffer overflows.

42
CVEs Resolved
1
Zero-Click Bluetooth RCE
8.8
CVSS Bluetooth
Critical
Wireless Patch Urgency

Triage Eksekutif dan Penilaian Risiko

The April 2026 release resolves CVE-2024-0044 in the Fluoride Bluetooth stack. An unchecked HCI packet fragment length caused heap corruption, allowing adjacent attackers within Bluetooth range to execute arbitrary code.

Matriks Triage Kerentanan Pilihan

Pengenal CVE Subsistem / Komponen Dampak CVSS Eksploitasi Aktif?
CVE-2024-0044Fluoride Bluetooth StackHeap Buffer Overflow / RCE8.8 HighYES (In-The-Wild)
CVE-2024-0045Android Wi-Fi ServiceInformation Disclosure6.5 MediumNo
CVE-2024-0046Sensors HALDenial of Service5.1 MediumNo
ANALISIS KODE PILIHAN

Deep Dive: Android Bluetooth HCI Heap Buffer Overflow Teardown →

Inspect the C commit in system/bt/stack/l2cap showing packet length assertion checks during ACL fragment reassembly.

← Jelajahi Direktori Keamanan Lengkap Semua Pembaruan Keamanan →