PT-2025-36040 · Unknown · Localbluetoothlebroadcast.Java

Published 2025-09-04 · Updated 2025-09-05 · CVE-2025-32330

Positive Technologies · (AI Summary)

CVSS v3.1

5.7

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

LocalBluetoothLeBroadcast.java (affected versions not specified)

Description:

An issue exists in the `generateRandomPassword` function of `LocalBluetoothLeBroadcast.java` that may allow interception of the Auracast audio stream due to an insecure default value. This could lead to remote information disclosure without requiring additional execution privileges or user interaction.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-32330

Affected Products

Localbluetoothlebroadcast.Java

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-32330 · Security Note
• https://source.android.com/security/bulletin/2025-09-01 · Note
• https://android.googlesource.com/platform/frameworks/base/+/5b10581d2a91ddb256a1e37efcbcdb015091f5a1 · Note
• https://twitter.com/CVEnew/status/1963827300895695026 · Twitter Post