CVE-2018-9454: In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check.

Security readout for executives and security teams

CVE-2018-9454 is an Android information disclosure flaw in a BNEP-related data handler. A missing bounds check could let an attacker read data outside the expected memory area. The public record says no extra privileges or user interaction are needed, but it does not provide a CVSS score or evidence of active exploitation. Exposure is most likely on legacy Android 6.0 through 8.1 devices that did not receive the relevant Android security bulletin fixes. Modern supported Android devices are less likely exposed, but device vendor patch levels should be verified rather than assumed. Treat this as a legacy mobile exposure issue. It is not presented as actively exploited, but affected Android versions are old and often unsupported. Priority should focus on finding unpatched devices and removing unsupported systems from sensitive use. Mitigation focus: Apply Android security updates covering the August 2018 bulletin where available.; Retire or isolate Android 6.0 through 8.1 devices that cannot be patched.; Check OEM guidance for device-specific patch availability and backports..

Prepared

Jun 6, 2026, 22:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.