● Android Bulletin · April 2026

Android Security Bulletin: April 2026 Bluetooth HCI Heap Triage

Technical triage of Android's April 2026 release addressing zero-click Bluetooth HCI fragmentation heap buffer overflows.

42
CVEs Resolved
1
Zero-Click Bluetooth RCE
8.8
CVSS Bluetooth
Critical
Wireless Patch Urgency

Triagem Executiva e Veredito de Risco

The April 2026 release resolves CVE-2024-0044 in the Fluoride Bluetooth stack. An unchecked HCI packet fragment length caused heap corruption, allowing adjacent attackers within Bluetooth range to execute arbitrary code.

Matriz Curada de Triagem de Vulnerabilidades

Identificador CVE Subsistema / Componente Impacto CVSS Exploração Ativa?
CVE-2024-0044Fluoride Bluetooth StackHeap Buffer Overflow / RCE8.8 HighYES (In-The-Wild)
CVE-2024-0045Android Wi-Fi ServiceInformation Disclosure6.5 MediumNo
CVE-2024-0046Sensors HALDenial of Service5.1 MediumNo
ANÁLISE DE CÓDIGO EM DESTAQUE

Deep Dive: Android Bluetooth HCI Heap Buffer Overflow Teardown →

Inspect the C commit in system/bt/stack/l2cap showing packet length assertion checks during ACL fragment reassembly.

← Navegar no Diretório de Segurança Todas as Atualizações de Segurança →