CVE-2026-56988

Received Received - Intake

Bluetooth Use-After-Free in Android Bluetooth Stack

Publication date: 2026-09-15

Last updated on: 2026-09-18

Assigner: Google Devices

Description

In multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-18

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-56988

EUVD

EUVD-2026-78986

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue caused by a race condition in the bluetooth_cco.cc file. It allows an attacker with system execution privileges to potentially escalate their local privileges.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain higher privileges on your system, potentially leading to unauthorized access or control. It requires system execution privileges but no user interaction.

Compliance Impact

This vulnerability involves a use-after-free due to a race condition in bluetooth_cco.cc, potentially allowing local privilege escalation with system execution privileges. It does not require user interaction for exploitation. While the vulnerability itself does not directly impact compliance with GDPR or HIPAA, such issues could lead to unauthorized access or data breaches if exploited, which may violate these regulations depending on the context of use.

Mitigation Strategies

Apply the latest security patches or updates provided by the vendor for the affected Bluetooth components. Monitor official advisories from the vendor for specific mitigation steps.

Hi! I’m here to help you understand CVE-2026-56988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70