CVE-2026-19292

14th percentile - higher than 14% of all known CVEs

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

Lowering the security level during re-pairing increases susceptibility to brute-force attacks on the LTK, potentially leading to Bluetooth session hijacking and confidentiality breaches.

Update Bluetooth device firmware to enforce the highest security level during re-pairing. Also consider requiring re-authentication when changing security levels.