CVE-2026-45515

CVE-2026-45515 is a heap buffer overflow, resulting in an out-of-bounds write, in a2dp_vendor_opus_decoder_decode_packet (a2dp_vendor_opus_decoder.cc), part of the Android Bluetooth stack's A2DP vendor Opus audio decoder. It is triggered when the device decodes a crafted or oversized Opus-encoded packet received over an A2DP Bluetooth audio connection, meaning a nearby device acting as the audio source can reach the vulnerable code with no user interaction and no additional privileges required. Successful exploitation yields local escalation of privilege, allowing an attacker to run code in the affected Bluetooth component with elevated capabilities. Android devices carrying the affected Bluetooth stack are potentially affected; Google patched the flaw in the September 2026 Android Security Update, and specific affected version ranges are not enumerated in the source data. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known, and EPSS estimates the 30-day exploitation probability at roughly 0.1%.

What to do: Apply the September 2026 Android Security Update (or an OEM build containing that patch level or later) as soon as it is rolled out to your devices. Until patched, reduce exposure by avoiding A2DP audio-sink connections with untrusted nearby Bluetooth devices and disabling Bluetooth when not in use. Verify devices show a September 2026 (or later) Android security patch level in Settings.