CVE-2026-0059: Android Heap Buffer Overflow in SDP Discovery – Remote Code Execution

Technical summary

CVE-2026-0059 is a heap buffer overflow (CWE-122) in sdp_discovery.cc, a core component of Android's Bluetooth and network discovery stack. The vulnerability exists in multiple functions within this module and allows an unauthenticated, low-privileged attacker to write beyond allocated heap boundaries. Exploitation results in arbitrary code execution within the context of the vulnerable process, with no need for elevated privileges or user interaction. The attack surface is proximal/adjacent, meaning the attacker must be on the same network or paired Bluetooth range.

Business impact

A successful exploit enables an attacker positioned on the same local network (or within Bluetooth proximity) to execute malicious code on an Android device without user awareness. This could lead to data exfiltration, lateral movement within a network, installation of persistent backdoors, or compromise of sensitive applications and stored credentials. Organizations managing Android fleets—particularly in enterprise or IoT contexts—face elevated risk of breach through this vector. The lack of user interaction requirement makes detection and prevention significantly harder.

Affected systems

Google Android devices are affected. The vulnerability resides in sdp_discovery.cc, which is a fundamental component of Android's connectivity stack. All Android versions using the vulnerable code path are potentially affected; patch status and specific version ranges should be verified against the vendor advisory.

Exploitability

Exploitability is moderate to high in real-world scenarios. While the attack requires network adjacency (not full internet exposure), the combination of low attack complexity, no privilege escalation needed, and zero user interaction makes this attractive to attackers with local network access. Bluetooth-enabled devices in public spaces or corporate networks are particularly exposed. No public exploit code or active KEV designation has been recorded as of the data snapshot, but the simplicity of triggering a buffer overflow suggests rapid weaponization is possible.

Remediation

Apply the security patch released by Google as soon as it becomes available. Patch rollout should be prioritized for devices in high-risk environments (corporate networks, healthcare facilities, financial institutions). Interim mitigations include disabling Bluetooth when not in use, limiting device exposure to untrusted networks, and segmenting network access to reduce the attack surface. Monitor for suspicious Bluetooth pairing attempts or unexpected network discovery activity.

Patch guidance

Check Google's Android Security & Privacy Year in Review or your device manufacturer's security bulletin for patch availability and version numbers. Patches will typically be delivered via over-the-air (OTA) updates. Encourage users to install updates promptly, and consider mandatory patch deployment in managed environments. Verify patch application by confirming the device build date and security patch level in device settings (typically under Settings > About Phone > Android Security Patch Level).

Detection guidance

Detection is challenging at the application layer since the exploit operates below user-visible processes. Focus on network-layer monitoring: look for unusual SDP discovery traffic patterns, malformed SDP packets from unknown sources, or repeated SDP queries from the same source address. Endpoint detection and response (EDR) tools should monitor for unexpected process spawning or memory corruption indicators. Enable Android's SELinux audit logging to capture potential exploitation attempts. Memory sanitizer logs and kernel crash reports may reveal heap corruption patterns.

Why prioritize this

This vulnerability warrants immediate attention due to its HIGH CVSS score (8.0), complete confidentiality and integrity impact, the absence of privilege escalation requirements, and zero user interaction needed for exploitation. The proximal/adjacent attack vector, while more constrained than network-wide exposure, is common in enterprise environments and public spaces. Early patching prevents opportunistic attacks by local network adversaries.

Risk score, explained

The CVSS 3.1 score of 8.0 (HIGH) reflects: (1) Attack Vector Adjacent—limiting but realistic in corporate and public networks; (2) Attack Complexity Low—no special conditions needed; (3) Privileges Required Low—standard user context sufficient; (4) User Interaction None—fully automated exploitation possible; (5) Scope Unchanged—impact confined to the vulnerable component; (6) Confidentiality, Integrity, and Availability all set to High—full system compromise achievable. The combination of ease of exploitation and severity of impact justifies the HIGH rating.

Frequently asked questions