Xint discloses three fixed Android memory-safety CVEs

Xint's tracker unembargoes three Android and Pixel CVEs covering a Bluetooth heap overflow and two LWIS memory-safety flaws.

Bug class: Heap overflow, out-of-bounds write, and use-after-free
Affected codebase: Android Bluetooth and Google Pixel LWIS
Credited system: Xint Code
Disclosed: August 25, 2026
Attribution: Self-reported attribution
Severity: high

Source status: Xint's tracker maps issues 26, 34, and 37 to exact CVEs and upstream Android or Pixel bulletins. The bulletins corroborate the fixes; Xint supplies the AI-system attribution.

Summary

CVE-2026-0095 is a Bluetooth heap overflow. CVE-2026-0138 is an out-of-bounds write in LWIS, and CVE-2026-0143 is an LWIS use-after-free. Google published the fixes in its June Android and Pixel bulletins; Xint made the corresponding tracker rows public on August 25.

The adjacent mediaextractor row remains outside the ledger because its tracker still says Fixed: TODO and supplies no CVE or equivalent accepted-fix record.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.