7.8

CVE-2026-49933

EPSS 0.07%
Veröffentlicht 05.10.2026 18:23:50
Zuletzt bearbeitet 07.10.2026 13:14:09
Erkennungen
Login

In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 3 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Android Version 16.0 Update -

Google ≫ Android Version 16.0 Update qpr2

Google ≫ Android Version 17.0 Update -

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.07%	0.001

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
CISA-ADP	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-824 Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.

https://source.android.com/docs/security/bulletin/2026/2026-10-01

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-49933

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-49933

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-49933

EUVD