PT-2025-36040 · Unknown · Localbluetoothlebroadcast.Java

Published 2025-09-01 · Updated 2025-09-05 · CVE-2025-32330

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LocalBluetoothLeBroadcast.java (affected versions not specified)

Description An issue exists in the generateRandomPassword function of LocalBluetoothLeBroadcast.java that may allow interception of the Auracast audio stream due to an insecure default value. This could lead to remote information disclosure without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1188

Related Identifiers

ASB-A-389127608

BDU:2025-11690

CVE-2025-32330

Affected Products

Localbluetoothlebroadcast.Java

References · 7

• https://osv.dev/vulnerability/CVE-2025-32330 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/5b10581d2a91ddb256a1e37efcbcdb015091f5a1 · Patch
• https://source.android.com/security/bulletin/2025-09-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32330 · Security Note
• https://bdu.fstec.ru/vul/2025-11690 · Security Note
• https://osv.dev/vulnerability/ASB-A-389127608 · Vendor Advisory
• https://twitter.com/CVEnew/status/1963827300895695026 · Twitter Post