CVE-2018-9365 is a high severity flaw in Android: a missing bounds check in smp_data_received of smp_l2c.cc. NVD scores it 8.8. Google fixed it in the July 2018 Android Security Bulletin. Devices at security patch level 2018-07-05 or later are covered, so check the level and update.
What's affected
The weakness is a missing bounds check in smp_data_received of smp_l2c.cc, in the Bluetooth stack security manager code. The bulletin entry is typed RCE and its affected versions column reads: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 and 8.1. The NVD record is dated 2024-11-19 and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The two sources disagree on severity. Google's bulletin rates it Critical, while NVD scores it 8.8 (High). Both are published figures and both are reported here. The versions differ too. The NVD record lists Android 6.0, 6.0.1 and 7.0, while the bulletin lists 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 and 8.1. Treat the bulletin as the wider list.
The fix is a platform patch, not something you install per app. Per the July 2018 bulletin, security patch levels of 2018-07-05 or later address all issues in that bulletin. Device makers include the fixes in their own updates, so the date a phone reaches that patch level depends on the manufacturer and carrier.
Weakness class: CWE-125.
How to check if you're exposed
Look at the security patch level, not the Android version number. The patch level is the date string that shows which monthly bulletins a device has absorbed.
On the device, open Settings, then About phone, then Android version, and read the Android security patch level. Exact menus vary by manufacturer.
For managed devices with USB debugging enabled, this reads the same value:
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.build.version.release
A patch level earlier than 2018-07-05 means this bulletin has not been fully applied. A device that no longer receives updates cannot be fixed this way and should be retired from sensitive use.
What to do now
- Find every Android device that touches company data and record its patch level, using your mobile device management tool or the commands above.
- Update devices below 2018-07-05 through the manufacturer or carrier channel.
- For devices that cannot reach that level, restrict access to email, source code and admin tools, or replace them.
- Set a compliance rule that blocks devices more than a set number of months behind on patch level.
- Read the original entry in the July 2018 bulletin for anything specific to your hardware.
Why it matters
The function smp_data_received handles Security Manager Protocol packets in the Bluetooth stack. The record says a missing bounds check allows an out of bounds read followed by code execution, with no extra privileges and with user interaction needed. NVD scores it 8.8 with a network attack vector.
The record lists CWE 125, out of bounds read. Bluetooth parsing code processes data from nearby devices before any trust is established, so a mistake here is exposed to anyone in radio range. Turning Bluetooth off when you do not need it reduces exposure, but the patch is the fix.
This CVE is not on the CISA Known Exploited Vulnerabilities list, and I found no statement of exploitation in the bulletin. That is not a reason to wait. Old Android issues linger because many devices never receive the monthly updates, and the record was only published to NVD in 2024, years after the bulletin.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the libraries your own apps ship, not the device operating system. Use it for the app side, and your device management tool for the patch level side.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which patch level fixes CVE-2018-9365?
Google's July 2018 bulletin says security patch levels of 2018-07-05 or later address its issues. Confirm the exact entry in the bulletin for your device and manufacturer.
Is CVE-2018-9365 exploited in the wild?
It is not listed in CISA's Known Exploited Vulnerabilities catalog, and the bulletin text I read does not say it was exploited. Patch anyway.
Sources
Last reviewed: 19 October 2026.
