CVE-2019-11516

CVE-2019-11516 is a heap-based buffer overflow vulnerability in the Bluetooth component of Cypress Wireless IoT codebase, affecting Google Android devices. It arises from improper handling of Extended Inquiry Responses (EIRs), allowing an attacker to exceed expected buffer sizes and potentially overwrite existing functions with arbitrary code. The vulnerability has a CVSS score of 8.1 (HIGH), indicating a network-based attack with high impact on confidentiality, integrity, and availability, but requiring high attack complexity due to the need for repeated connections from different source addresses. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.