In avrc_pars_browse_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over Bluetooth with no additional exe

The impact of CVE-2019-1996 is the potential for remote information disclosure. An attacker within Bluetooth range could exploit this vulnerability to read sensitive data from the device's memory. The specific data exposed depends on the contents of the Bluetooth buffer, but it could include configuration information, application data, or even cryptographic keys. The lack of user interaction makes this vulnerability particularly concerning, as it can be exploited without any interaction from the device owner. The potential for remote exploitation significantly increases the attack surface.

1. 予約済み2018-12-10
2. 公開日2019-02-28
3. 更新日2024-09-17
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2019-1996 is to upgrade affected Android devices to version 8.0.1 or later. If upgrading is not immediately feasible, consider disabling Bluetooth functionality when not in use. Network segmentation can limit the potential impact of this vulnerability. Monitoring Bluetooth traffic for unusual patterns may also help detect potential exploitation attempts. After upgrading, confirm the fix by attempting to trigger the vulnerable function and verifying that no memory access errors occur.