Google Android: Out-of-bounds write in Bluetooth storage (cfg2prop)
Summary
A heap buffer overflow in the cfg2prop function of the Android Bluetooth storage code (btif_storage.cc) allows an out-of-bounds write. The CVE record states that this could lead to remote code execution without additional execution privileges and without user interaction. Google's October 2026 bulletin classifies the issue as a critical elevation of privilege in the System component, so the exact impact should be verified against the bulletin and the NVD record.
Affected
- Android 16
- Android 16-qpr2
- Android 17
- Android 14 and 15 are not listed for this CVE in the bulletin.
Fixed in
- Security patch level 2026-10-01 or later
- Specific AOSP build tags or commit hashes: Unknown.
Workaround
Unknown. No vendor workaround found. The patch level is the remedy.
Exploitation
- Not known to be exploited. CISA ADP Vulnrichment does not mark it as known exploited.
- CISA SSVC assessment: Exploitation none, not automatable.
- No public proof of concept found.
Our recommendation
- Install the Android 2026-10-01 security patch level or later on all affected devices.
- Check the patch level of Android 16, 16-qpr2 and 17 devices in your mobile device management.
- Disable Bluetooth on devices where it is not needed.
- Verify the impact type in the Google bulletin and NVD record.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin—October 2026 source.android.com
- CISA ADP Vulnrichment summary (hol.org) hol.org
- Fleet: Android October 2026 patch level verification fleetdm.com
- Vulert: Android vulnerability database search vulert.com
- TechRepublic: Samsung October 2026 security update www.techrepublic.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:31.
Original description (NVD)
In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.