CVE-2025-26438 Overview
CVE-2025-26438 is an authentication bypass vulnerability in the Android Bluetooth stack, specifically in the smp_process_secure_connection_oob_data function of smp_act.cc. The flaw stems from an incorrect implementation of the Security Manager Protocol (SMP), allowing attackers to bypass Bluetooth pairing authentication during Secure Connections out-of-band (OOB) data processing. Successful exploitation enables remote escalation of privilege without user interaction. The vulnerability affects Android versions 13, 14, and 15, and was addressed in the Android Security Bulletin dated May 1, 2025. The weakness is categorized under [CWE-287] (Improper Authentication).
Critical Impact
Attackers within Bluetooth range can bypass SMP pairing authentication and escalate privileges on Android devices without any user interaction.
Affected Products
- Google Android 13
- Google Android 14
- Google Android 15
Discovery Timeline
- 2025-09-04 - CVE-2025-26438 published to the National Vulnerability Database (NVD)
- 2025-09-05 - Last updated in NVD database
Technical Details for CVE-2025-26438
Vulnerability Analysis
The vulnerability resides in the smp_process_secure_connection_oob_data function within smp_act.cc, part of the Android Bluetooth module. This function handles OOB data exchanged during Bluetooth Low Energy (BLE) Secure Connections pairing. The Security Manager Protocol (SMP) governs pairing, key generation, and authentication between Bluetooth peers.
Due to incorrect protocol implementation, the function fails to enforce expected authentication checks when processing OOB pairing material. An attacker can manipulate the OOB exchange to complete pairing without satisfying the protocol's authentication requirements. This grants the attacker an authenticated Bluetooth relationship with the target device, which can then be leveraged for further privileged access to Bluetooth profiles and services.
Root Cause
The root cause is an improper implementation of the SMP Secure Connections OOB authentication flow. The function does not correctly validate the authentication state derived from OOB inputs, violating the protocol contract defined in the Bluetooth Core Specification. This logic flaw maps to [CWE-287] (Improper Authentication).
Attack Vector
The attack is delivered over the network attack surface as classified by the CVSS scoring methodology, reflecting the remote, wireless nature of Bluetooth. An adjacent attacker initiates an SMP pairing exchange with the target and supplies crafted OOB data. Because the flaw bypasses authentication entirely, no user prompt or confirmation appears on the target device. After pairing, the attacker holds privileges typically reserved for trusted Bluetooth peers and can access protected GATT services or profiles.
No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-26438
Indicators of Compromise
- Unexpected Bluetooth pairing events on Android devices without corresponding user confirmation prompts.
- Anomalous BLE Secure Connections OOB pairing exchanges originating from unknown peers.
- New entries in the device's bonded device list that cannot be attributed to user activity.
Detection Strategies
- Monitor Android Bluetooth pairing logs (logcat Bluetooth tag) for SMP pairing completions without user-interactive consent.
- Inspect mobile device management (MDM) telemetry for Android security patch level prior to 2025-05-01 on managed devices.
- Hunt for Bluetooth bonding activity in environments where Bluetooth use is restricted by policy.
Monitoring Recommendations
- Enforce MDM compliance rules requiring the May 2025 (or later) Android security patch level.
- Audit Bluetooth-related events captured by enterprise mobility and EDR telemetry feeding into the SIEM.
- Track unusual proximity-based pairing activity in sensitive locations such as executive offices and SCIFs.
How to Mitigate CVE-2025-26438
Immediate Actions Required
- Apply the Android security patch level 2025-05-01 or later on all affected Android 13, 14, and 15 devices.
- Disable Bluetooth on devices that cannot be updated, particularly in high-risk environments.
- Enforce MDM policies that block non-compliant devices from accessing corporate resources.
Patch Information
Google addressed the issue in the May 2025 Android Security Bulletin. The upstream fix is committed to the Android Bluetooth module at change e6130675c04752947ac4779c178ce70eb959a97f. See the Android Bluetooth Patch and the Android Security Bulletin May 2025 for details. Device manufacturers ship the fix through their respective firmware updates, so timing varies by OEM.
Workarounds
- Turn off Bluetooth when not actively in use to remove the attack surface.
- Avoid pairing with unknown Bluetooth peripherals, especially in public spaces.
- Restrict Bluetooth pairing through enterprise device policy where business needs allow.
# Check current Android security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output should be 2025-05-01 or later
# Example compliant output: 2025-05-01
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
