Executive brief
Android's audio codec decoder for Opus-over-A2DP Bluetooth audio contains a heap buffer overflow vulnerability in packet decoding. An attacker with local access could exploit this flaw to escalate privileges and gain elevated system access without needing to interact with the user or inject additional code.
Technical details
A heap buffer overflow exists in the a2dp_vendor_opus_decoder_decode_packet function in a2dp_vendor_opus_decoder.cc, where insufficient bounds checking during Opus audio packet decoding allows an out-of-bounds write to heap memory. The vulnerability is triggered during normal packet processing with no additional execution privileges required and no user interaction needed. An attacker with local code execution can exploit this to corrupt heap memory structures and achieve local privilege escalation. Patches are available in Android Security Bulletin September 2026 for AOSP versions 14, 15, 16, 16-qpr2, and 17 with security patch level 2026-09-05 or later.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Android Security Bulletin September 2026, patch level 2026-09-05 or later