A flaw in the msft.cc component of Android’s Bluetooth daemon allows an attacker to exploit an uninitialized pointer, leading to a control-flow hijack of the privileged bluetooth process. The resulting escalation can grant higher privilege to the attacker without the need for any user interaction. This vulnerability provides a clear privilege elevation path for local attackers, potentially enabling wide-ranging system compromises such as modifying system settings, installing malicious software, or accessing sensitive data.

Google Android devices running the affected Bluetooth daemon, as referenced by the Android Security Bulletin for October 2026. The specific versions are not enumerated in the current data, but any device with the unpatched msft.cc implementation is vulnerable.

The exploitation requires local access to the device and no user interaction, meaning any malicious code already present on the system can trigger the escalation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the vulnerability is local and does not require external network exposure, the attack vector is inferred to be local code execution. The CVSS score of 7.8 indicates a high severity, reinforcing the need for immediate remediation.