CVE-2025-36911

Published Jan 15, 2026

Last updated 3 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36911, also known as "WhisperPair," is a vulnerability found in the key-based pairing process of Bluetooth audio accessories that utilize Google's Fast Pair protocol. The flaw stems from a logic error in the code, where devices may fail to properly verify if they are in pairing mode. This oversight allows an attacker in close physical proximity to exploit the vulnerability without requiring additional execution privileges or user interaction. Successful exploitation of CVE-2025-36911 can lead to remote information disclosure, potentially exposing users' conversations and location data. Attackers can forcibly pair vulnerable accessories with their own devices, gaining control over the audio device. This could enable actions such as playing audio at high volumes, recording conversations through the device's microphone, or tracking the user's location if the accessory supports Google's Find Hub network.

Description: In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
Source: dsap-vuln-management@google.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.1
Impact score: 4.2
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity: HIGH

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 11

References

Sources include official advisories and independent security research.

Overview

AI description

Risk scores

CVSS 3.1

Social media

References