In the Android Bluetooth stack, a race condition in the handle_app_val_response function can let an attacker run arbitrary code and gain higher privileges on the device. No user interaction is required, so the flaw can be triggered automatically by a malicious Bluetooth device or background process. This timing error in response handling permits a complete loss of device security.

The vulnerability impacts Android devices that include the Bluetooth radio stack component referenced in btif_rc.cc. Specific Android version numbers are not disclosed, so all releases containing the vulnerable code path are at risk. Administrators should consult the official Google Security Bulletin for affected editions.

The CVSS score of 7.0 classifies this flaw as medium to high severity. The lack of an EPSS value leaves the exploitation likelihood uncertain, but the race condition allows local privilege escalation without additional privileges and can be triggered without user interaction. Although not listed in the CISA KEV catalog, its ability to fully compromise a device warrants urgent remediation. Attackers would need proximity or observed traffic to manipulate the race condition, lowering the barrier to exploitation.