A use after free vulnerability in the Bluetooth stack of Google Android 15 allows an attacker to achieve local escalation of privilege.

This is a use after free vulnerability located in rfc_send_buf_uih of rfc_ts_frames.cc. The flaw allows for local escalation of privilege without requiring additional execution privileges or user interaction.

Successful exploitation of this vulnerability permits an attacker to escalate privileges locally on the affected device, potentially leading to full system compromise. Given the CVSS score of 8.4, this vulnerability represents a significant risk to data confidentiality, integrity, and system availability. Unauthorized access to elevated privileges may lead to the exfiltration of sensitive user data or the installation of persistent malicious software.

Immediate Action: Consult the March 2025 Android Security Bulletin and apply the latest security patches provided by Google or the device manufacturer.

Proactive Monitoring: Monitor system logs for unusual process behavior or crashes related to the Bluetooth service that may indicate attempted exploitation.

Compensating Controls: Ensure that device security features, such as verified boot and SELinux policies, are fully enabled to limit the potential impact of local privilege escalation attempts.

Public Exploit Available: Unknown

This vulnerability presents a high risk due to the potential for privilege escalation within the Android Bluetooth subsystem. Organizations and individual users should prioritize the application of the relevant security updates as soon as they are made available by their device vendor to eliminate this attack vector.