CVE-2026-55330CWE-416

CVE-2026-55330

Critical · published October 6, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-416 · Use After Free
Published
2026-10-06T23:18Z
References (1)
https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01 · [email protected]
EPSS history
Timeline
  • 08 OCT 03:30Z
    EPSS moved — → 0%
    epss
  • 06 OCT 18:20Z
    In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code
    cvelistv5