A logic error in Android’s handling of Bluetooth Low Energy pairing allows a device to accept a pairing request without user interaction, enabling an attacker who is in physical proximity to elevate privileges on the target device. The flaw does not require additional execution privileges and can be triggered from an adjacent Bluetooth‑enabled device, allowing an attacker to assume higher rights on the victim phone without any visible prompt.

The vulnerability affects Android devices, including all models that implement the affected Bluetooth Low Energy pairing logic. No specific OS or firmware versions were listed in the advisory, so all devices that currently run the unpatched pairing routine are potentially impacted.

The exploit can be carried out remotely from an adjacent device, eliminating the need for social engineering or user interaction. The CVSS score of 8 indicates a high severity level. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and proximity-based exploit still warrant immediate attention.