CVE-2017-13256:

Out-of-bounds write vulnerability in Android's Bluetooth SDP server allowing remote code execution

This vulnerability (CWE-787: Out-of-bounds Write) affects the Bluetooth stack in Android devices. The flaw exists in the Service Discovery Protocol (SDP) server implementation, which is responsible for handling service discovery requests from other Bluetooth devices. When processing service search attribute requests, the code fails to properly validate input boundaries, allowing an attacker to write data beyond allocated memory buffers. An attacker within Bluetooth range of a vulnerable device can exploit this vulnerability to execute arbitrary code with the privileges of the Bluetooth service. Since the Bluetooth service typically runs with elevated privileges, this could lead to complete device compromise. The attack doesn't require any user interaction or authentication, making it particularly dangerous.