CVE-2025-26441: Google Android Information Disclosure

CVE-2025-26441 is an information disclosure vulnerability in Google Android caused by an out of bounds read in sdp_discovery.cc. This flaw enables remote attackers to access sensitive data without user interaction. This post covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-26441 Overview

CVE-2025-26441 is an out-of-bounds read vulnerability in the Android Bluetooth stack. The flaw resides in the add_attr function within sdp_discovery.cc, where a missing bounds check allows a remote attacker to read memory beyond the intended buffer. Successful exploitation results in information disclosure without requiring user interaction or additional execution privileges. The vulnerability affects Android 13, 14, and 15 and was addressed in the Android Security Bulletin for June 2025.

Critical Impact
Remote attackers within Bluetooth range can leak sensitive memory contents from Android devices without user interaction, potentially exposing data useful for further exploitation.

Affected Products

Google Android 13
Google Android 14
Google Android 15

Discovery Timeline

2025-09-04 - CVE-2025-26441 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26441

Vulnerability Analysis

The vulnerability exists in the Service Discovery Protocol (SDP) handling code of the Android Bluetooth module, specifically in the add_attr function of sdp_discovery.cc. SDP is the Bluetooth subsystem responsible for discovering services offered by remote devices and negotiating their attributes. When parsing attribute data returned from a remote peer, the function fails to validate that the attribute length remains within the bounds of the receive buffer.

An attacker who can initiate an SDP transaction with a target device can craft attribute responses that cause the parser to read past the end of allocated memory. The out-of-bounds read leaks adjacent heap contents back to the attacker as part of the SDP exchange. The weakness is classified under [CWE-125: Out-of-bounds Read].

Root Cause

The root cause is a missing bounds check in add_attr. The function processes attribute type-length-value (TLV) structures without verifying that the declared attribute length fits within the remaining unparsed data. When the length field exceeds the buffer boundary, the subsequent copy or read operation accesses memory outside the intended region.

Attack Vector

Exploitation requires network-adjacent access over Bluetooth and low privileges on the target. No user interaction is required. An attacker within Bluetooth range initiates or responds to SDP discovery and returns a malformed attribute record. The Android Bluetooth process parses the record, reads out-of-bounds memory, and includes that memory in its internal state or in subsequent responses observable by the attacker. The disclosed memory may contain pointers, cryptographic material, or other data useful for chaining into further attacks.

The upstream fix is available in the Android Bluetooth Module Update.

Detection Methods for CVE-2025-26441

Indicators of Compromise

Unexpected or repeated SDP service discovery requests originating from unknown Bluetooth peers.
Bluetooth process crashes or abnormal memory access logs in logcat referencing sdp_discovery or add_attr.
Unrecognized paired or attempted-pair devices appearing in device Bluetooth history.

Detection Strategies

Monitor mobile device management (MDM) telemetry for Android builds missing the June 2025 security patch level (SPL 2025-06-01 or later).
Inspect Bluetooth HCI (Host Controller Interface) logs for malformed SDP attribute responses with oversized length fields.
Correlate Bluetooth pairing anomalies with proximity-based access patterns in enterprise environments.

Monitoring Recommendations

Enforce security patch level compliance checks through MDM policies for all managed Android endpoints.
Enable Bluetooth HCI snoop logging on high-risk devices to capture SDP transactions during incident response.
Track and alert on devices remaining on Android 13, 14, or 15 without the June 2025 patch.

How to Mitigate CVE-2025-26441

Immediate Actions Required

Apply the June 2025 Android security patch (SPL 2025-06-01) or later to all affected devices.
Prioritize patching for devices used in sensitive environments where Bluetooth is routinely enabled.
Audit the fleet through MDM to identify devices still running vulnerable Android 13, 14, or 15 builds.

Patch Information

Google addressed CVE-2025-26441 in the Android Security Bulletin June 2025. The upstream code change is committed to the Bluetooth module and available in the Android Bluetooth Module Update. Device manufacturers distribute the fix through carrier and vendor over-the-air (OTA) updates.

Workarounds

Disable Bluetooth on affected devices when not actively in use, particularly in public or untrusted environments.
Set Bluetooth visibility to non-discoverable to reduce exposure to unsolicited SDP requests.
Remove paired devices that are no longer needed to limit the number of trusted SDP initiators.

bash

# Verify Android security patch level via adb
adb shell getprop ro.build.version.security_patch

# Disable Bluetooth via adb (requires appropriate permissions)
adb shell svc bluetooth disable