CVE-2024-43766: Google Android Info Disclosure Flaw

CVE-2024-43766 Overview

CVE-2024-43766 is a vulnerability affecting multiple functions within the btm_ble_sec.cc file in Android's Bluetooth stack. The flaw stems from invalid error handling that can result in unencrypted communication between Bluetooth Low Energy (BLE) devices. An attacker within adjacent network range could exploit this vulnerability to intercept sensitive information transmitted over Bluetooth connections without requiring any user interaction or additional execution privileges.

Critical Impact

Remote (proximal/adjacent) information disclosure vulnerability in Android Bluetooth stack that could allow attackers to intercept sensitive data transmitted over unencrypted BLE connections.

Affected Products

• Google Android 14.0
• Google Android 15.0
• Google Android 16.0

Discovery Timeline

• 2026-03-02 - CVE-2024-43766 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2024-43766

Vulnerability Analysis

This vulnerability exists in the Bluetooth Low Energy security implementation within Android's Bluetooth stack, specifically in the btm_ble_sec.cc source file. The core issue is a cleartext transmission of sensitive information (CWE-319) that occurs due to improper error handling in the BLE security functions.

When certain error conditions are encountered during the BLE pairing or encryption negotiation process, the error handling logic fails to properly enforce encryption requirements. Instead of terminating the connection or re-initiating the encryption handshake, the flawed error handling allows communication to continue in an unencrypted state. This creates an opportunity for attackers within Bluetooth range to capture sensitive data that should have been protected by encryption.

The vulnerability requires the attacker to be within adjacent network proximity (typically within Bluetooth range of approximately 10-100 meters depending on the device class). No authentication or special privileges are required to exploit this flaw, and the attack can be conducted without any interaction from the victim user.

Root Cause

The root cause is invalid error handling in multiple functions within btm_ble_sec.cc. When the BLE security layer encounters specific error conditions during the encryption setup or maintenance phase, the error handling code does not properly enforce that communications must remain encrypted. This allows a fallback to unencrypted communication channels, violating the security expectations of BLE connections that should be encrypted.

Attack Vector

The attack vector is adjacent network access, meaning an attacker must be within Bluetooth communication range of the target device. The exploitation scenario involves:

1. Attacker positions themselves within Bluetooth range of a vulnerable Android device
2. The attacker monitors BLE traffic while the victim device is communicating with another Bluetooth device
3. Through manipulation or natural occurrence of error conditions, the vulnerable error handling triggers unencrypted communication
4. The attacker passively captures sensitive information that was intended to be transmitted over an encrypted BLE channel

The vulnerability does not require user interaction and can be exploited without additional execution privileges on the target device. The attack primarily results in confidentiality loss through information disclosure.

Detection Methods for CVE-2024-43766

Indicators of Compromise

• Unusual Bluetooth traffic patterns showing unencrypted BLE communications when encryption should be active
• Bluetooth connection logs showing repeated encryption negotiation failures or fallbacks
• Anomalous BLE pairing events or connection state changes in device logs

Detection Strategies

• Monitor Android system logs for Bluetooth-related error messages, particularly those involving btm_ble_sec.cc functions
• Implement network monitoring for unencrypted BLE traffic in environments where encrypted Bluetooth communications are expected
• Deploy endpoint detection solutions capable of identifying anomalous Bluetooth stack behavior

Monitoring Recommendations

• Enable verbose Bluetooth logging on Android devices to capture detailed connection state information
• Implement centralized log collection for mobile device management (MDM) environments to aggregate Bluetooth-related events
• Regularly audit Bluetooth connection security status on managed Android devices

How to Mitigate CVE-2024-43766

Immediate Actions Required

• Apply the March 2026 Android Security Patch as soon as available for affected devices
• Consider disabling Bluetooth functionality on devices handling sensitive information until patches are applied
• Limit use of BLE-connected peripherals in sensitive environments until remediation is complete

Patch Information

Google has addressed this vulnerability in the Android Security Bulletin March 2026. Organizations should prioritize updating affected Android devices running versions 14.0, 15.0, and 16.0 to the latest security patch level dated 2026-03-01 or later.

Device manufacturers and carriers may release updates on varying schedules. Check with your device manufacturer for specific patch availability.

Workarounds

• Disable Bluetooth when not actively in use to reduce the attack surface
• Avoid using Bluetooth in public spaces or untrusted environments where attackers could be within range
• Use alternative secure communication methods for sensitive data transfers until the patch is applied
• Implement MDM policies to enforce Bluetooth restrictions on managed enterprise devices

# Android ADB command to disable Bluetooth (requires root or ADB shell access)
adb shell settings put global bluetooth_on 0