Heap Buffer Overflow in Android Bluetooth A2DP Opus Decoder Enables Privilege Escalation
AI analysis
CVE-2026-45515 is a heap buffer overflow, resulting in an out-of-bounds write, in a2dp_vendor_opus_decoder_decode_packet (a2dp_vendor_opus_decoder.cc), part of the Android Bluetooth stack's A2DP vendor Opus audio decoder. It is triggered when the device decodes a crafted or oversized Opus-encoded packet received over an A2DP Bluetooth audio connection, meaning a nearby device acting as the audio source can reach the vulnerable code with no user interaction and no additional privileges required. Successful exploitation yields local escalation of privilege, allowing an attacker to run code in the affected Bluetooth component with elevated capabilities. Android devices carrying the affected Bluetooth stack are potentially affected; Google patched the flaw in the September 2026 Android Security Update, and specific affected version ranges are not enumerated in the source data. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known, and EPSS estimates the 30-day exploitation probability at roughly 0.1%.
What to do: Apply the September 2026 Android Security Update (or an OEM build containing that patch level or later) as soon as it is rolled out to your devices. Until patched, reduce exposure by avoiding A2DP audio-sink connections with untrusted nearby Bluetooth devices and disabling Bluetooth when not in use. Verify devices show a September 2026 (or later) Android security patch level in Settings.
Affected
| Google (Android Open Source Project) Android Bluetooth stack - A2DP vendor Opus decoder (a2dp_vendor_opus_decoder.cc) | — |
Estimated exposure
massbillions of Android devices (platform-wide; ~3B+ active Android installs) — The vulnerable decoder ships in the shared AOSP Bluetooth stack used across the multi-billion-device Android install base, so exposure is estimated at platform scale, though only devices that receive A2DP audio via the vendor Opus codec…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.