CVE-2023-35657 - In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion

Back Back to CVE browser

MEDIUM

In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion

Published Sep 4, 2025

4.0

MEDIUM

CVSS 3.1

EPSS 0.09%

Description

In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor Google Product Android Default
unaffected
- Version
  13
  Status
  affected
  Constraints
  -
- Version
  14
  Status
  affected
  Constraints
  -
- Version
  15
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google

Android

unaffected

Version	Status	Constraints
13	affected	-
14	affected	-
15	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (3)

Link	Providers	Tags
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/655dbc919736f0a67c5d408e91b6c0a47fb7ccc3		Patch
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-39657		Advisory
https://source.android.com/security/bulletin/2025-05-01		Vendor Advisory