Android devices can be compromised through a use‑after‑free condition in multiple functions of bluetooth a local attacker to trigger memory corruption and gain system‑level execution privileges. This flaw is a classic example of a dangerous memory safety weakness, specifically a use‑after‑free (CWE-416) and a race condition (CWE-362) that bypasses user authentication and does not require any user interaction.

The vulnerability affects Android operating systems, specifically the Bluetooth stack shipped by Google. No specific OS version is listed, so all firmware builds that include the affected bluetooth_cco.cc code may be susceptible.

The CVSS base score of 6.4 indicates moderate severity; the EPSS score is < 1%, and the flaw is not in the CISA KEV catalog. Based on the description, the likely attack vector is local exploitation on the device, possibly through malicious Bluetooth the device. Because the race condition does not dependary could trigger the flaw by generating competing Bluetooth requests or messages that manipulate shared state while the system is running. This could allow the attacker to write to arbitrary memory locations and elevate privileges.