Out-of-bounds write (CWE-787) in Adobe Acrobat Reader and Acrobat 2024 enables arbitrary code execution in the context of the current user when a victim opens a crafted malicious PDF or document file. Affected versions span Acrobat 2024 up to 24.001.30383 and both Acrobat and Acrobat Reader through 26.002.21900, per Adobe PSIRT advisory APSB26-141. No public exploit or CISA KEV listing has been identified at time of analysis, though the C:H/I:H/A:H CVSS impact and prevalence of Adobe Reader in enterprise environments make this a meaningful patching priority.
Use-After-Free in Adobe Acrobat Reader and Adobe Acrobat allows arbitrary code execution in the security context of the current user upon opening a specially crafted PDF file. Affected versions span Acrobat Reader up to 26.002.21900 and Acrobat 2024 up to 24.001.30383, as documented in Adobe advisory APSB26-141. No public exploit identified at time of analysis, but the file-delivery attack vector makes this a realistic phishing and drive-by-download threat given Acrobat Reader's ubiquity as an enterprise PDF handler.
Use-after-free memory corruption in Adobe Acrobat Reader enables arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file. All three Adobe Acrobat product lines are affected - Acrobat Reader and Adobe Acrobat up to 26.002.21900, and Acrobat 2024 up to 24.001.30383 - with Adobe disclosing the issue via security advisory APSB26-141. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, but the file-open delivery model pairs naturally with phishing campaigns targeting knowledge workers who routinely open PDF attachments.
Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.
Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. Affects Android 14, 15, 16, 16-qpr2, and 17; no public exploit or CISA KEV listing identified at time of analysis.
Local privilege escalation in Android's NFC stack affects devices running Android 14 through 17 via an out-of-bounds write triggered by a logic error in rw_mfc_handle_read_op, the MiFare Classic card read-operation handler in rw_mfc.cc. An attacker holding low-privilege local code execution can corrupt adjacent memory and escalate to higher system privileges with no additional privileges or user interaction required. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the five-release breadth of affected versions spans the bulk of the active Android install base, making this a meaningful patch target.
Heap buffer overflow in Android's Bluetooth A2DP Opus vendor codec decoder allows a local low-privileged attacker to escalate privileges with no user interaction required. The flaw resides in `a2dp_vendor_opus_decoder_decode_packet` within `a2dp_vendor_opus_decoder.cc`, where a crafted Opus-encoded audio stream can trigger an out-of-bounds write on the heap. Affected versions span Android 14 through Android 17; no public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none.
Use-after-free memory corruption in Arm's Bifrost, Valhall, and 5th Gen GPU userspace drivers allows a local non-privileged process - including through browser-exposed WebGL or WebGPU operations - to access already-freed memory regions, achieving full confidentiality, integrity, and availability impact. The flaw spans driver revisions from r42p0 through r55p0 across all three GPU families, covering a substantial portion of the Android Mali GPU ecosystem deployed in MediaTek and Samsung Exynos SoCs. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), but the WebGL/WebGPU trigger path is a notable attack surface reduction that warrants prompt patching on affected devices.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture Kernel Drivers enables a local unprivileged process to access deallocated kernel memory through valid GPU memory processing operations, resulting in full confidentiality, integrity, and availability compromise (CVSS C:H/I:H/A:H). The flaw spans broad version ranges across all three driver families from r44p0 through r54p3/r55p0, affecting a large population of devices built on Arm Mali GPU hardware. No active exploitation is confirmed at time of analysis (EPSS 0.14%, no CISA KEV listing), but UAF vulnerabilities in kernel-mode GPU drivers are a well-established and historically weaponized local privilege escalation vector on Android and Linux platforms.
Use-after-free in Arm's Bifrost, Valhall, and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed GPU memory, yielding full confidentiality, integrity, and availability impact within the kernel driver context. Affected revisions span a wide range across all three driver families - from r49p3 through r55p0 depending on the product line - placing a large population of Android and embedded Arm devices in scope. No public exploit code exists at time of analysis, and EPSS sits at 0.14% (4th percentile), though the low-complexity local attack surface characteristic of GPU driver UAFs has historically attracted sophisticated actors targeting mobile platforms.
Use-after-free in Arm's Valhall and 5th Gen GPU Architecture kernel drivers allows a local non-privileged process to access freed kernel memory by submitting valid GPU processing operations, with potential for full system compromise across confidentiality, integrity, and availability (CVSS C:H/I:H/A:H). Both driver families are affected from r50p0 through r54p3 and at r55p0, covering a wide swath of devices - notably Android smartphones and embedded SoCs - that rely on these GPU drivers. No active exploitation is confirmed (EPSS 0.14%, 4th percentile; no CISA KEV listing) at time of analysis.
Local privilege escalation in Auth0 AD/LDAP Connector versions up to and including 6.5.0 allows a low-privileged local user to modify the connector's configuration file due to improper permission handling during service startup processing. When the connector service restarts - whether scheduled, OS-triggered, or manually - the tampered configuration value is evaluated, resulting in code execution with the privileges of the service account running the connector. No public exploit code has been identified at time of analysis, but the straightforward local exploitation path (AC:L) and high impact to a service that often holds privileged Active Directory credentials make this a meaningful risk in environments running on-premise Auth0 connector deployments.
Factory Reset Protection (FRP) in Android 14 through 17 can be bypassed via a logic error in `findMetaAuthUid` within `AccountsDb.java`, allowing a local attacker with minimal privileges to gain full control of a device without additional permissions or any victim interaction. All currently supported Android major versions are confirmed affected per Google's September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, though the total CIA impact (C:H/I:H/A:H) means successful exploitation yields complete device compromise.
Local privilege escalation in Android's package installer component allows a low-privilege app to push unauthorized updates to other installed applications by exploiting a permissions bypass in InstallRepository.kt. Affected versions are Android 17 and Android 16-qpr2, as disclosed in the September 2026 Android Security Bulletin. No user interaction is required for exploitation; SSVC signals no confirmed active exploitation and EPSS sits at 0.13%, indicating limited real-world activity at time of analysis.
Background Activity Launch (BAL) bypass in Android's LauncherAppsService allows a low-privilege local application to launch foreground activities from the background without user awareness or interaction. The flaw resides in `buildIntentSenderForUser` within `LauncherAppsService.java`, where authorization checks (CWE-863) are insufficient to prevent background callers from obtaining a valid intent sender that sidesteps Android's BAL restrictions. Affected versions include Android 16, Android 16-QPR2, and Android 17; no public exploit identified at time of analysis.
Background activity launch bypass in Android's RemoteViews framework allows a locally installed malicious application with basic user privileges to escalate to full device compromise without user interaction. Multiple functions in RemoteViews.java contain a logic error (CWE-693) that defeats Android's background activity launch (BAL) protection mechanism, enabling unprivileged apps to launch foreground activities from background context. Affecting Android 14, 15, 16, 16-QPR2, and 17, this has broad attack surface across the Android ecosystem; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android's Window Manager Service (WindowState.java) allows a low-privileged app to bypass overlay protection mechanisms across Android versions 14 through 17. The logic error in setHiddenWhileSuspended permits unauthorized overlay windows to remain visible or interact with the display even when they should be hidden for suspended apps, creating a pathway to full CIA compromise on the device. No public exploit has been identified at time of analysis, and EPSS scores the exploitation probability at just 0.13% (3rd percentile), though SSVC rates technical impact as total.
Intent redirection bypass in Android's ActivityManagerService enables a low-privileged local app to escalate privileges and gain full device access without any user interaction. The logic error in addCreatorToken of ActivityManagerService.java corrupts the creator-token mechanism that governs Intent origin and authority, allowing a malicious app to redirect Intents to system-protected components that should be inaccessible to it. EPSS at 0.13% (3rd percentile) and no CISA KEV listing indicate limited observed exploitation; no public exploit has been identified at time of analysis.
Local privilege escalation in Android's memory allocator affects versions 14 through 17, enabling a low-privileged process to gain elevated system privileges without any user interaction. The root cause is a logic error in the LimitRealloc function within malloc_limit.cpp that produces a use-after-free condition, granting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.12% (2nd percentile), though the SSVC framework rates technical impact as total.
Local privilege escalation in Android 16, 16-QPR2, and 17 is possible via Intent Redirection by exploiting a logic error in ActivityStarter.java's resolveActivity method. A locally-installed malicious application with basic user privileges can craft or intercept Intents to gain unauthorized access to protected system components, achieving full confidentiality, integrity, and availability compromise of the device without requiring any user interaction after installation. EPSS is 0.12% (2nd percentile) and no active exploitation or public POC has been identified at time of analysis.
Heap buffer overflow in the `read_boot_region` function of Android's filesystem check utility (`fsck.c`) allows a local, low-privileged process to escalate privileges with full system impact. The flaw spans Android 14 through 17 (including QPR2 branches) and was disclosed in Google's September 2026 Android Security Bulletin. No public exploit code has been identified at time of analysis, and EPSS signals a very low current exploitation probability.
Local privilege escalation in Android 14 through 16 allows a low-privileged application to gain full system-level access by exploiting a confused deputy flaw in the ActivityTaskManagerService. The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java, where the service can be manipulated into exercising its elevated permissions on behalf of an unprivileged caller, bypassing Android's permission model. No additional execution privileges or user interaction are required, and no public exploit has been identified at time of analysis.
Privilege escalation in Android's PickActivity allows any installed low-privileged application to silently bypass the 'Install unknown apps' security restriction, enabling unauthorized APK installation without user consent across Android 14, 15, 16, and 16-QPR2. The root cause is a confused deputy flaw (CWE-441) in the setupLayout method of PickActivity.java, where the privileged activity can be manipulated into performing installation actions on behalf of a less-privileged caller, circumventing a core Android security boundary. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H scoring across all current Android releases.
Privilege escalation in Android's cross-profile intent-forwarding mechanism (IntentForwarderActivity.java) allows a locally installed low-privilege application to bypass the user consent dialog presented by buildMiniResolver via a tapjacking or overlay attack, achieving full confidentiality, integrity, and availability impact across Android 14 through 17 including the QPR2 train. The vendor explicitly states no user interaction is required, indicating the consent bypass is mechanically triggered against the framework rather than requiring the victim to tap attacker-crafted UI. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.12% (2nd percentile) and SSVC Automatable=no confirm no observed mass exploitation.
Local privilege escalation in Android 16 through 17 exploits incorrect authorization (CWE-863) across multiple URI access control locations, allowing a low-privileged process to bypass permissions checks and achieve full read/write/execute access on the device without requiring user interaction. Reported by security@android.com and addressed in the September 2026 Android Security Bulletin, the flaw affects Android 16, Android 16-QPR2, and Android 17. No public exploit has been identified and EPSS sits at the 2nd percentile, though SSVC rates the technical impact as total.
Local privilege escalation in Android's Slice permission subsystem allows a low-privileged installed application to bypass permission checks via a confused deputy flaw in SlicePermissionActivity.java's onCreate method. Affecting Android 14 through 17 (including the 16-QPR2 branch), the vulnerability requires no user interaction and grants full C:H/I:H/A:H impact on a successful device. No public exploit has been identified at time of analysis, and EPSS scoring (0.12%, 2nd percentile) reflects low current exploitation activity.
Background activity launch (BAL) restrictions in Android 15, 16, 16-qpr2, and 17 can be bypassed by a locally installed application exploiting a confused deputy pattern spanning multiple framework functions. A low-privileged app manipulates one or more privileged Android system components into launching background activities on its behalf, circumventing protections designed to block unauthorized UI intrusion and enabling local privilege escalation with full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; EPSS at 0.12% (2nd percentile) reflects low observed exploitation activity despite the 7.8 CVSS score.
Local privilege escalation in Android's Settings app (SettingsFragment.java) affects Android 14 through 17, including 16-qpr2, allowing a low-privileged local attacker to gain full device control via misleading or insufficient UI in the getItemList method. No victim interaction is required - the attacker's own low-privileged app or session is sufficient to trigger the UI bypass. EPSS is 0.12% (2nd percentile) and SSVC records no active exploitation, but SSVC simultaneously rates technical impact as total, reflecting the severity of a successful attack despite limited observed real-world activity.
Local privilege escalation affects Android versions 16, 16-qpr2, and 17 via heap-based buffer overflow triggered by integer overflow in multiple framework locations. An attacker with basic local code execution (low-privileged app or shell) can exploit the memory safety flaw - requiring no additional privileges or user interaction - to gain full control of the device, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is identified at time of analysis; EPSS of 0.12% (2nd percentile) indicates low probability of near-term observed exploitation.
Out-of-bounds write vulnerabilities in multiple Android system functions allow a local, low-privileged attacker to escalate to root on Android 16-QPR2 and Android 17 without requiring any user interaction. The root cause is integer overflow (CWE-787) that underestimates buffer allocation size, enabling memory writes beyond allocated regions and corruption of privilege-sensitive data structures. The September 2026 Android Security Bulletin addresses these issues, and no public exploit has been identified at time of analysis.
Out-of-bounds write in Android's NFC MIFARE Classic read handler (`rw_mfc_handle_read_op` in `rw_mfc.cc`) enables a local low-privileged process to escalate to higher execution privileges with no user interaction. The flaw spans Android 14, 15, 16, 16-QPR2, and 17, covering the full range of currently supported Android releases. Google addressed this in the September 2026 Android Security Bulletin; no public exploit code has been identified at time of analysis.
Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.
Privilege escalation in Android's ActivityStarter component (Android 14 through 16-qpr2) allows a locally-installed application with standard permissions to launch background activities outside Android's background launch restrictions, achieving full device compromise. The flaw resides in the executeRequest method of ActivityStarter.java, where a logic error fails to properly enforce the protection mechanism (CWE-693) that prevents unauthorized background activity launches. No public exploit has been identified at time of analysis; EPSS stands at 0.12% (2nd percentile), consistent with the SSVC exploitation status of none.
Local privilege escalation in Android's telephony stack allows a low-privilege app to send USSD requests without the required telephony permission, bypassing Android's permission model through a logic error in handleUssdRequest of PhoneInterfaceManager.java. Affected releases span Android 14 through 17 including the 16-QPR2 branch, with no user interaction required post-installation. USSD access can reach carrier-side services capable of triggering sensitive device operations, making a successful exploit a pathway to full device compromise.
Multi-user isolation breaks in Android's ClipboardService framework layer (CWE-284 Improper Access Control) across Android 14 through 17, enabling a locally-executed low-privileged process to cross user-profile boundaries and escalate privileges with full confidentiality, integrity, and availability impact. The logic error in setClipboardAccessNotificationsEnabledForUser fails to correctly enforce per-user access checks, allowing one user context to manipulate clipboard access notification state for other user profiles on the same device. No public exploit has been identified at time of analysis, and EPSS of 0.12% places this at the 2nd percentile for near-term exploitation probability.
Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.
Out-of-bounds write in Android's camera metadata validation logic (validate_camera_metadata_structure in camera_metadata.c) allows a local low-privileged attacker to escalate privileges to a higher-privileged context with full confidentiality, integrity, and availability impact. Affects Android 14 through 16-qpr2, patched in the September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; EPSS sits at the 2nd percentile and SSVC rates exploitation as none.
Local privilege escalation in Android 16 and 16-QPR2 allows a low-privileged app to escalate to full device control by exploiting a logic error in HostEmulationManager.java that permits unauthorized background activity launches. The flaw stems from CWE-693 (Protection Mechanism Failure) in the activity-launch gating logic, enabling an installed malicious app to bypass Android's background activity restrictions without requiring additional permissions or user interaction. No public exploit has been identified and CISA has not added this to KEV, but SSVC rates the technical impact as total given that successful exploitation yields C:H/I:H/A:H on the device.
Local privilege escalation in Android's BackgroundLaunchProcessController allows a low-privileged app or user process to launch background activities beyond its permitted scope due to a logic error in the areBackgroundActivityStartsAllowed gating function. Affected versions span Android 14 through Android 16-QPR2, covering the vast majority of modern Android devices in active use. With PR:L and UI:N, exploitation requires only a foothold as a regular user-space app - no user interaction or elevated permissions - making it a reliable post-installation escalation primitive. No public exploit exists and CISA SSVC rates exploitation as none at time of analysis.
Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.
Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.
Silent NFC payment session hijacking in Android 15 and 16 allows a locally-installed low-privilege application to exploit missing permission checks in NfcService.java, enabling unauthorized manipulation of NFC payment sessions without any user interaction. The flaw is a missing authorization gate (CWE-862) across multiple functions in the NFC service, permitting a malicious app to hijack, enable, or redirect contactless payment flows targeting the device. No public exploit has been identified and CISA SSVC rates exploitation as none, though the financial-fraud potential elevates practical risk beyond what the EPSS score of 0.11% suggests.
Local privilege escalation in Android's AppRestrictionsFragment allows a low-privileged app to gain unauthorized read/write access to private files via a confused deputy in the assertSafeToStartCustomActivity method. Affected versions span Android 14, 15, 16, 16-QPR2, and 17, making this a broad-surface vulnerability across the current Android ecosystem. With PR:L/UI:N, a malicious installed app can silently exploit this without user interaction to achieve full local C:H/I:H/A:H impact. No public exploit identified at time of analysis; EPSS is 0.11% (2nd percentile).
Local privilege escalation in Android's PaymentDefaultDialog allows an attacker with standard app-level execution to silently replace the device's default NFC payment application via a confused deputy in the component's onCreate method. Affecting Android 15, 16, 16-qpr2, and 17, the flaw is patched in the September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, and EPSS sits at 0.11%, consistent with SSVC's 'Exploitation: none' designation despite the high technical impact potential.
Tapjacking and UI overlay exploitation in Android 16-QPR2's `InstallLaunch.kt` `onCreate` method allows a locally-installed malicious application to present a deceptive interface over the package installation workflow, leading to local privilege escalation with full confidentiality, integrity, and availability impact. Fixed in Google's September 2026 Android Security Bulletin, the flaw requires no additional execution privileges and - per the CVSS vector - no user interaction beyond what occurs during the overlay setup phase. No public exploit code and no active exploitation have been identified at time of analysis; EPSS sits at 0.11% (2nd percentile).
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Out-of-bounds write (CWE-787) in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) enables arbitrary code execution in the context of the logged-in user. The attack is triggered by opening a specially crafted document, making phishing attachments and compromised file-sharing platforms viable delivery mechanisms against creative and design professionals. No public exploit identified at time of analysis, but the low attack complexity and full CIA impact across affected versions represent a meaningful and realistic risk.
Local privilege escalation in the Android kernel's IOMMU subsystem (iommu.c) allows any process with basic user-level execution to gain full kernel privileges through out-of-bounds memory read/write triggered by improper input validation across multiple functions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required, making this a reliable local privilege escalation primitive for post-compromise chains or malicious apps. Google patched this in the Android Security Bulletin for September 2026 with two upstream kernel commits; no public exploit has been identified at time of analysis.
Privilege escalation in Android's SmsController affects versions 14, 15, 16, and 16-QPR2 due to missing permission checks across multiple functions. A locally-running application with basic privileges can invoke these unguarded entry points to gain full read, write, and availability impact on the device without any user interaction. No public exploit or active KEV listing exists at time of analysis; Google addressed this in the September 2026 Android Security Bulletin.