CVE-2026-0059: In multiple functions of sdp_discovery

Synopsis

A heap buffer overflow in Android's Bluetooth SDP (Service Discovery Protocol) implementation allows an attacker on the same network segment, such as a local Bluetooth radio range, to execute arbitrary code on the target device. The flaw is reachable over an adjacent network connection and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives the attacker full read, write, and execution control over the affected process. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network segment, such as within Bluetooth radio range or the same local LAN or VPN, to reach the vulnerable SDP service.

• AuthenticationRequired

  A low-privilege account or Bluetooth pairing context is sufficient; no administrative credentials are required.

• Victim interactionNot required

  No action from the device owner or any other user is needed to trigger the overflow.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout prerequisites are required to succeed.

Blast Radius

• Attacker executes arbitrary code within the Bluetooth stack process on the target device.
• Full confidentiality impact: the attacker reads memory contents accessible to the affected process, including stored session data or credentials.
• Full integrity impact: the attacker modifies process memory and persisted data reachable from the Bluetooth stack.
• Full availability impact: the attacker can crash or destabilize the Bluetooth service or the broader system process it runs within.