● Android Bulletin · April 2026

Android Security Bulletin: April 2026 Bluetooth HCI Heap Triage

Technical triage of Android's April 2026 release addressing zero-click Bluetooth HCI fragmentation heap buffer overflows.

42
CVEs Resolved
1
Zero-Click Bluetooth RCE
8.8
CVSS Bluetooth
Critical
Wireless Patch Urgency

보안 릴리스 분석 및 위험성 평가

The April 2026 release resolves CVE-2024-0044 in the Fluoride Bluetooth stack. An unchecked HCI packet fragment length caused heap corruption, allowing adjacent attackers within Bluetooth range to execute arbitrary code.

핵심 취약점 트리아지 매트릭스

CVE 식별자 서브시스템 / 구성 요소 영향 CVSS 실제 악용 여부?
CVE-2024-0044Fluoride Bluetooth StackHeap Buffer Overflow / RCE8.8 HighYES (In-The-Wild)
CVE-2024-0045Android Wi-Fi ServiceInformation Disclosure6.5 MediumNo
CVE-2024-0046Sensors HALDenial of Service5.1 MediumNo
주목할 코드 분석

Deep Dive: Android Bluetooth HCI Heap Buffer Overflow Teardown →

Inspect the C commit in system/bt/stack/l2cap showing packet length assertion checks during ACL fragment reassembly.

← 전체 보안 디렉터리 보기 모든 플랫폼 보안 업데이트 →