CVE-2026-0059: Google Android RCE Vulnerability

CVE-2026-0059 Overview

CVE-2026-0059 is a heap buffer overflow vulnerability in multiple functions of sdp_discovery.cc, a component of the Android Bluetooth stack responsible for Service Discovery Protocol (SDP) operations. An attacker within Bluetooth range can trigger memory corruption and achieve remote code execution without user interaction. The flaw affects Android 14, 15, and 16, including Android 16 QPR2 beta releases. Google disclosed the issue in the Android Security Bulletin dated June 1, 2026.

Critical Impact

Adjacent-network attackers can execute arbitrary code in the Bluetooth process context with no user interaction required, enabling proximity-based device compromise.

Affected Products

• Google Android 14.0
• Google Android 15.0
• Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3)

Discovery Timeline

• 2026-06-01 - Google publishes the Android Security Bulletin addressing CVE-2026-0059
• 2026-06-01 - CVE-2026-0059 published to the National Vulnerability Database (NVD)
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-0059

Vulnerability Analysis

The vulnerability resides in sdp_discovery.cc, the source file implementing client-side Service Discovery Protocol parsing in the Android Bluetooth stack. Multiple functions within this file mishandle bounds checks when processing SDP response data received from a remote device. Processing a malformed or oversized SDP attribute can write past the bounds of a heap-allocated buffer.

The weakness is classified as a heap-based buffer overflow [CWE-122]. Exploitation occurs over the Bluetooth adjacent network and requires low privileges on the local device because the Bluetooth daemon must be active. No user interaction is required to trigger the parsing path once an SDP session is initiated.

Successful exploitation yields high impact on confidentiality, integrity, and availability. Code execution occurs in the Bluetooth process, which has access to paired device data, audio streams, and inter-process communication channels on Android.

Root Cause

The root cause is improper validation of length or offset fields embedded in SDP response attributes. Functions in sdp_discovery.cc allocate heap buffers based on expected sizes but copy attribute payloads without enforcing those boundaries against attacker-controlled length descriptors.

Attack Vector

The attack vector is adjacent (Bluetooth radio range). An attacker operates a malicious Bluetooth peer or impersonates one already paired and sends crafted SDP responses during service discovery. The Android target parses the malformed response and corrupts heap memory in the Bluetooth process, leading to code execution.

No verified public proof-of-concept code is available. See the Android Security Bulletin June 2026 for vendor-provided technical detail.

Detection Methods for CVE-2026-0059

Indicators of Compromise

• Unexpected crashes or restarts of the com.android.bluetooth process logged in logcat or tombstone files
• Heap corruption signatures in native crash dumps referencing functions inside sdp_discovery.cc
• Repeated SDP service discovery requests from unknown or unpaired Bluetooth peers in proximity

Detection Strategies

• Monitor Android device crash telemetry for native aborts in the Bluetooth stack, particularly SIGSEGV or SIGABRT signals tied to SDP parsing frames
• Correlate Bluetooth pairing and discovery events with subsequent process crashes to surface exploitation attempts
• Inventory mobile fleet OS build numbers against the June 2026 Android security patch level to identify unpatched devices

Monitoring Recommendations

• Aggregate mobile device crash and Bluetooth event logs into a centralized analytics platform for trend analysis
• Alert on anomalous Bluetooth discovery activity in high-risk environments such as executive travel or sensitive facilities
• Track Android security patch level (ro.build.version.security_patch) across managed endpoints to confirm patch adoption

How to Mitigate CVE-2026-0059

Immediate Actions Required

• Apply the June 2026 Android security patch (security patch level 2026-06-01 or later) on all affected devices
• Through mobile device management (MDM), enforce minimum patch levels and quarantine devices that cannot update
• Disable Bluetooth on devices that do not require it, especially when operating in untrusted physical environments

Patch Information

Google addressed CVE-2026-0059 in the Android Security Bulletin published on June 1, 2026. Device manufacturers integrate the fix into vendor-specific OTA updates following the bulletin. Refer to the Android Security Bulletin June 2026 for the authoritative patch reference and source code links.

Workarounds

• Keep Bluetooth disabled when not actively in use to remove the attack surface
• Set Bluetooth visibility to non-discoverable and avoid pairing with unknown devices
• Restrict use of affected Android versions in high-risk environments until the patch is applied

# Verify the Android security patch level on a device via ADB
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-06-01 or later