PT-2025-11050 · Bluetooth · Bluetooth

Published 2025-03-01 · Updated 2025-08-27 · CVE-2023-21125

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bluetooth (affected versions not specified)

Description: A memory corruption issue exists due to a use-after-free condition in the btif hh hsdata rpt copy cb function within bta hh.cc. This could allow for local privilege escalation over Bluetooth without requiring additional execution privileges or user interaction.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Use After Free

Weakness Enumeration

CWE-400

CWE-416

Related Identifiers

ASB-A-228837201

CVE-2023-21125

Affected Products

Bluetooth

References · 9

• https://source.android.com/security/bulletin/2025-03-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21125 · Security Note
• https://osv.dev/vulnerability/ASB-A-228837201 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-21125 · Vendor Advisory
• https://twitter.com/CVEnew/status/1960480972597514433 · Twitter Post
• https://reddit.com/r/k12cybersecurity/comments/1j9jwl5/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://t.me/cveNotify/133694 · Telegram Post
• https://android.googlesource.com/platform/system/bt/+/e7b978841deb331ff5e5849388fa92ee4c40f979 · Note
• https://t.me/cveNotify/133612 · Telegram Post