CVE-2026-0095: In l2c_fcr_clone_buf of l2c_fcr

Synopsis

This is a heap corruption vulnerability caused by an integer overflow in the Android Bluetooth stack, specifically in the l2c_fcr_clone_buf function of l2c_fcr.cc. An attacker with a low-privilege account on the device and adjacent network access (such as Bluetooth radio range) can trigger the flaw without any victim interaction, corrupting memory inside the privileged Bluetooth process. Successful exploitation grants the attacker local escalation of privilege, giving them control at a higher permission level than their original account. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attack requires adjacency to the target over a local wireless medium such as Bluetooth radio range or LAN; remote exploitation over the open internet is not possible.

• AuthenticationRequired

  The attacker must hold at least a low-privilege account or session on the target device; unauthenticated access is not sufficient.

• Victim interactionNot required

  No user action such as clicking a link or accepting a pairing request is needed; exploitation is fully attacker-driven.

• Attack complexityDetail

  Exploit conditions are reliable and free of race conditions or special environmental requirements, making repeated attempts straightforward.

Blast Radius

• Attacker gains escalated privileges within the Android Bluetooth process, gaining permissions beyond their original low-privilege account.
• Controlled heap corruption allows reads of memory held by the privileged Bluetooth process, exposing sensitive data such as paired device keys or communication payloads.
• Heap corruption allows writes to memory in the privileged process, enabling tampering with Bluetooth communication state or injecting attacker-controlled data.
• The privileged Bluetooth process can be destabilized or crashed, disrupting all Bluetooth-dependent functionality on the device.