In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow.

published 2023-09-11 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-39681

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits: 0; none known

In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Patch / fix

links 1

android.googlesource.com/platform/packages/modules/Bluetooth/+/d8d95291f16a8f18f8ff… commit

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 2 y ago (2024-09-26)

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Google Android

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-787 Out-of-bounds Write

References

android.googlesource.com /platform/packages/modules/Bluetooth/+/d8d95291f16a8f18f8ffbd6322c14686897c5730
vendor-advisory
source.android.com /security/bulletin/2023-09-01
vendor-advisory

Sources

CVE List CVE-2023-35681
NVD CVE-2023-35681

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary