Platform
android
Component
android-bluetooth-stack
Fixed in
7.0.1
CVE-2019-1991 is a Remote Code Execution (RCE) vulnerability affecting the Android Bluetooth Stack. It arises from a buffer overflow in the btifdmdata_copy function, requiring user interaction for exploitation. Affected Android versions range from 7.0 to 9. A fix is available in Android 7.0.1.
The impact of CVE-2019-1991 is severe, as it allows for remote code execution within the Bluetooth stack. A successful exploit could grant an attacker control over the device's Bluetooth functionality, potentially enabling them to intercept communications, install malware, or even gain full control of the device. The requirement for user interaction means that the attacker needs to trick the user into pairing with a malicious Bluetooth device or initiating a Bluetooth connection with a compromised system. Given the Bluetooth stack's role in device communication, the blast radius of this vulnerability is significant.
CVE-2019-1991 was published on February 28, 2019. It has an Android ID of A-110166268. There is no public indication of active exploitation campaigns targeting this specific vulnerability. Public Proof-of-Concept (PoC) code may exist, but its availability and ease of use are not widely reported. The EPSS score is likely low to medium, reflecting the requirement for user interaction.
Exploit Status
EPSS
1.00% (77% percentile)
The primary mitigation for CVE-2019-1991 is to update Android devices to version 7.0.1 or later. If an immediate update is not possible, disable Bluetooth when not in use and be cautious when pairing with unknown Bluetooth devices. Implement robust input validation and sanitization practices in Bluetooth applications. While a direct WAF rule is unlikely, monitoring Bluetooth connections for unusual behavior could provide early detection. After upgrading, verify the fix by attempting to reproduce the vulnerability with known exploit vectors and confirming that the buffer overflow is prevented.
Actualice a la última versión de Android disponible proporcionada por el fabricante de su dispositivo. Consulte el boletín de seguridad de Android para obtener más detalles.
Vulnerability analysis and critical alerts directly to your inbox.
It's a Remote Code Execution (RCE) vulnerability in the Android Bluetooth Stack due to a buffer overflow.
If you're using Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, or 9 and haven't updated, you're potentially affected. Update to Android 7.0.1 or later.
Update your Android device to version 7.0.1 or later. Disable Bluetooth when not in use and be cautious when pairing with unknown devices.
There's no widespread evidence of active exploitation, but the potential exists.
Check the Android Security Bulletin and the National Vulnerability Database (NVD) for more details.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your build.gradle file and we'll tell you instantly if you're affected.