{"id":"CVE-2026-95405","kind":"vulnerability","aliases":["CVE-2026-95405"],"related":[],"title":"Android Bluetooth: buffer underflow in BQR offload lets a local app escalate privileges","description":"In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"An incorrect bounds check in the Bluetooth BQR offload code allows a buffer size underflow and an out-of-bounds write. A local process can use this to escalate its privileges without user interaction.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","bluetooth","infrastructure","local-privilege-escalation"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T20:19:48+00:00","first_seen_at":"2026-11-10T20:46:17+00:00","triaged_at":"2026-11-10T20:49:22+00:00","updated_at":"2026-11-10T20:49:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:49:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Android Bluetooth: buffer underflow in BQR offload lets a local app escalate privileges","impact":"high","summary":"An incorrect bounds check in the Bluetooth BQR offload code allows a buffer size underflow and an out-of-bounds write. A local process can use this to escalate its privileges without user interaction.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["android","bluetooth","local-privilege-escalation"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local process gains elevated privileges on the device","analyst_note":"Check the Android Security Bulletin for the patch level that fixes CVE-2026-95405 and which devices are affected.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources describe a local privilege escalation in Bluetooth offload code (bt_bqr_offload.cc), which is part of the Android platform stack. Devices running an affected Android build are likely exposed; the sources do not list affected versions or patch levels.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4551,"output_tokens":444,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-95405':16A,19A 'acquirememori':63C 'addit':99C 'allow':37B 'android':1A,20B 'app':11A 'bluetooth':2A,21B,33B 'bound':29B,47B,76C,87C 'bqr':6A,34B 'bt_bqr_offload.cc':65C 'buffer':3A,39B,80C 'check':30B,88C 'code':36B 'could':90C 'cve':14A,17A 'due':83C 'escal':12A,26B,56B,94C 'execut':100C 'exploit':109C 'incorrect':28B,86C 'infrastructur':22B 'interact':61B,104C 'lead':91C 'let':8A 'local':10A,24B,50B,93C 'local-privilege-escal':23B 'need':102C,107C 'offload':7A,35B 'out-of-bound':44B 'possibl':69C 'privileg':13A,25B,58B,96C,101C 'process':51B 'size':40B,81C 'trigger':72C 'underflow':4A,41B,82C 'use':53B 'user':60B,103C 'via':78C 'way':70C 'without':59B 'write':48B,77C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a local privilege escalation in Bluetooth offload code (bt_bqr_offload.cc), which is part of the Android platform stack. Devices running an affected Android build are likely exposed; the sources do not list affected versions or patch levels.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","bluetooth","infrastructure","localprivilegeescalation","unknown"],"campaign_type":null,"search_a":"'-2026':15A,18A '-95405':16A,19A 'android':1A 'app':11A 'bluetooth':2A 'bqr':6A 'buffer':3A 'cve':14A,17A 'escal':12A 'let':8A 'local':10A 'offload':7A 'privileg':13A 'underflow':4A","search_b":"'allow':37B 'android':20B 'bluetooth':21B,33B 'bound':29B,47B 'bqr':34B 'buffer':39B 'check':30B 'code':36B 'escal':26B,56B 'incorrect':28B 'infrastructur':22B 'interact':61B 'local':24B,50B 'local-privilege-escal':23B 'offload':35B 'out-of-bound':44B 'privileg':25B,58B 'process':51B 'size':40B 'underflow':41B 'use':53B 'user':60B 'without':59B 'write':48B","search_c":"'acquirememori':63C 'addit':99C 'bound':76C,87C 'bt_bqr_offload.cc':65C 'buffer':80C 'check':88C 'could':90C 'due':83C 'escal':94C 'execut':100C 'exploit':109C 'incorrect':86C 'interact':104C 'lead':91C 'local':93C 'need':102C,107C 'possibl':69C 'privileg':96C,101C 'size':81C 'trigger':72C 'underflow':82C 'user':103C 'via':78C 'way':70C 'write':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95405","severity":null,"published_at":"2026-11-10T20:19:48+00:00","modified_at":"2026-11-10T20:19:48+00:00","first_seen_at":"2026-11-10T20:46:17+00:00","fetched_at":"2026-11-10T20:46:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}