Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Google Android Bluetooth component may leak data

CVE-2021-0431 · published 5 years ago
Summary

The Bluetooth software in Google Android (google/platform/system/bt) can read memory it shouldn't, potentially revealing information to a paired device. No user interaction or special permissions are required for the leak. Update the Android system to the latest security patch or apply the vendor’s recommended fix.

What to do
  • Update google platform/system/bt to version 8.1:2021-04-01.
  • Update google platform/system/bt to version 9:2021-04-01.
  • Update google platform/system/bt to version 10:2021-04-01.
  • Update google platform/system/bt to version 11:2021-04-01.
Affected software
Ecosystem VendorProductAffected versions
Android google platform/system/bt >= 8.1:0, < 8.1:2021-04-01
>= 9:0, < 9:2021-04-01
>= 10:0, < 10:2021-04-01
>= 11:0, < 11:2021-04-01
Fix: upgrade to 8.1:2021-04-01
– google android 8.1
9.0
10.0
11.0
cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*
Original advisory text
In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execut...
In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published1 Apr 2021
Updated3 Nov 2026
First seen10 Sep 2026
Sources
ASB-A-174149901 · OSV
CVE-2021-0431 · NVD
Track software like this
Free during beta