A critical use after free vulnerability in the Android Bluetooth sdp_server component enables unauthenticated remote code execution on Android 15 devices.

This vulnerability is a use after free flaw located in multiple functions of sdp_server.cc, triggered by a logic error. It allows an unauthenticated, adjacent attacker to achieve remote code execution without user interaction.

The ability for an unauthenticated attacker to execute arbitrary code on a mobile device presents a severe risk to organizational data integrity and confidentiality. Given the CVSS score of 8.8, this vulnerability is classified as High, reflecting the potential for total system compromise, including unauthorized access to sensitive user data and device control.

Immediate Action: Update affected Android 15 devices to the security patch level specified in the March 2025 Android Security Bulletin.

Proactive Monitoring: Monitor Bluetooth traffic for anomalous patterns or unexpected connection attempts to the sdp_server component.

Compensating Controls: Disable Bluetooth functionality on mobile devices when not in use to reduce the attack surface for proximal exploitation.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention for all deployments of Android 15. Administrators should verify the current security patch level of their mobile fleets and prioritize the deployment of the March 2025 security update to mitigate the risk of remote code execution.