Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in multiple functions of the btm_sec.cc file, where a logic error allows an attacker to intercept SMS messages.

Exploitation requires user interaction but does not need any additional execution privileges.

It is classified as an Information Disclosure issue with a CVSS base score of 4.3, indicating a moderate severity.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability could remotely intercept SMS messages, leading to disclosure of potentially sensitive information.

Since no additional privileges are required, the risk is that an attacker might gain access to SMS content without elevated permissions, but user interaction is necessary.

There is no indication of impact on integrity or availability, only confidentiality is affected.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure your device is running Android 17 with the security patch level 2026-07-01 or later.

Android partners were notified prior to public disclosure, and the issue is addressed in this update.

No active exploitation or abuse of this vulnerability has been reported, but applying the patch is recommended to prevent potential information disclosure.

Useful 0 Not Useful 0