CVE-2026-55269: Android Bluetooth SnoopLogger Heap Write

CVE-2026-55269 is a memory-safety flaw in Android Bluetooth SnoopLogger that could lead to local privilege escalation. Under a specific developer logging configuration, a short controller packet could reach a fixed-string write without enough buffer space. Google corrected the inverted resize guard and bounded the parsed length.

💡 Plain English Explainer (ELI5)

Imagine a clerk stamping the word “PROHIBITED” onto a narrow parcel. The parcel should be given extra wrapping first, but a backwards sign made the clerk skip that step for the smallest parcels. The fix pads the small packet before the stamp and caps the recorded length to the actual padded parcel.

Core Concepts & Subsystem Terms

SnoopLogger: Android Bluetooth code that filters and records captured HCI packets. The affected path is reached only with the documented filtered logging configuration.
HCI ACL packet: A Bluetooth host-controller data packet. The upstream change description says an unusually short packet can expose the undersized-buffer path when the relevant filter is enabled.
EXTRA_BUF_SIZE: Extra capacity added before the fixed “PROHIBITED” marker is written into a filtered packet. The fix makes sure small packets receive this padding.
CWE-20: Improper input validation. CISA ADP maps this weakness; the concrete defect was an inverted size condition in packet-buffer handling.

Framework mappings

FlawOpen’s conceptual mapping to MITRE CWE; no vendor or CVE record assigned this weakness ID to this research demonstration. CWE-20

Root Cause Analysis

The October 2026 Android bulletin lists CVE-2026-55269 for Android 16, 16 QPR2, and 17. NVD currently shows a CISA ADP CVSS 3.1 score of 7.8 (High), while Google's bulletin labels the System entry Critical; these are different severity assessments and should not be conflated. In the upstream Bluetooth commit, SnoopLogger::FilterCapturedPacket enters the filtered PBAP/MAP path and may later write the fixed PROHIBITED marker in PayloadStrip. The vulnerable guard used packet.size() + EXTRA_BUF_SIZE > DEFAULT_PACKET_SIZE before resizing. That condition skipped padding when the packet was small, leaving insufficient capacity. The fix changes the comparison to <= and clamps the parsed length to packet.size() + PACKET_TYPE_LENGTH. The commit describes a malicious Bluetooth controller sending a short HCI ACL packet, but the relevant Developer Options and SnoopLogger filter settings must be enabled; this is not an internet-reachable unauthenticated Android service. Google identifies the patch level, not a universal OEM rollout date. No exploit payload is reproduced here.

Step-by-Step Attack Flow

Step 1

A narrow logging configuration is active

The source commit describes Developer Options with Bluetooth SnoopLogger filtering active and a PBAP/MAP filter profile set to magic. Do not generalize this path to every Android device or default configuration.

Step 2

A controller supplies an unusually short packet

A malicious Bluetooth controller can send a short HCI ACL packet into the filtered capture path. The article omits packet bytes and operational trigger details.

Step 3

The backwards guard omits required padding

FilterCapturedPacket used a > comparison where <= was needed. Small packets bypassed the EXTRA_BUF_SIZE resize, but later filtering could write the fixed PROHIBITED marker into the undersized buffer.

Step 4

The upstream patch restores the buffer invariant

The fix pads eligible short packets and clamps the parsed length to the available packet data. Install a device update with security patch level 2026-10-01 or later when provided by the manufacturer.

Source Code: Flaw vs. Secure Implementation

This excerpt follows Google's public AOSP change: the comparison is reversed so a small packet receives the extra capacity intended for the marker, and the parsed length is capped to the available packet size. The commit also adds short-packet tests. The code is a reduced illustration of the upstream fix, not a standalone patch for a device; install the OEM update carrying Android patch level 2026-10-01 or later.

Source excerpt: packages/modules/Bluetooth/system/gd/hal/snoop_logger.cc — FilterCapturedPacket

UNPATCHED FLAW

if (packet.size() + EXTRA_BUF_SIZE > DEFAULT_PACKET_SIZE) {
  // Small packets should receive space for the filter marker.
  packet.resize(packet.size() + EXTRA_BUF_SIZE);
}

// Later, PayloadStrip writes the fixed PROHIBITED marker.

HARDENED SECURE PATCH

if (packet.size() + EXTRA_BUF_SIZE <= DEFAULT_PACKET_SIZE) {
  // Pad eligible short packets before filtering.
  packet.resize(packet.size() + EXTRA_BUF_SIZE);
}

// Keep the parsed length within the resized packet.
length = std::min(
    length, static_cast<uint32_t>(packet.size() + PACKET_TYPE_LENGTH));

Engineering & System Hardening Checklist

✓Check the device's Android security patch level and install a manufacturer update at 2026-10-01 or later when available; do not assume AOSP publication means every OEM device has shipped it.
✓For Android Bluetooth maintainers, preserve regression tests for short incoming and outgoing packets under the filtered PBAP/MAP magic profile.
✓When resizing a packet before a fixed-width marker write, prove the allocated capacity covers the marker and every later access.
✓Clamp parsed lengths to the actual buffer capacity after any resize; reject inconsistent packet lengths before downstream processing.
✓Do not treat the CVSS score as proof of a remote internet attack: the upstream fix description requires a specific Developer Options and SnoopLogger filter configuration and a malicious Bluetooth controller.
✓Track the severity labels accurately: Google lists the entry as Critical in its bulletin, while NVD's CISA ADP enrichment currently shows CVSS 3.1 7.8 High.