In bta_hl_sdp_query_results of bta_hl_main.cc, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User

The impact of CVE-2019-1992 is significant due to its potential for remote code execution. An attacker could exploit this vulnerability by crafting a malicious Bluetooth connection request that triggers the use-after-free condition. This could allow them to gain control of the device, potentially stealing sensitive data, installing malware, or even using the device as a pivot point to attack other systems on the network. The requirement for user interaction limits the immediate attack surface, but it still presents a considerable risk in scenarios where users are tricked into connecting to a malicious Bluetooth device. The lack of additional execution privileges needed is a concerning factor, as it lowers the barrier to entry for attackers.

1. Réservé2018-12-10
2. Publiée2019-02-28
3. Modifiée2024-09-16
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2019-1992 is to upgrade affected Android devices to version 7.0.1 or later. If upgrading is not immediately feasible, consider temporarily disabling Bluetooth functionality to reduce the attack surface. While a direct WAF or proxy rule is unlikely to be effective against this low-level Bluetooth vulnerability, network segmentation can limit the potential blast radius. Monitoring Bluetooth connections for unusual activity may also help detect potential exploitation attempts. After upgrading, confirm the fix by attempting a Bluetooth connection with a known-good device and verifying that no unexpected behavior occurs.