Out-of-bounds write in Android's NFC MIFARE Classic read handler (`rw_mfc_handle_read_op` in `rw_mfc.cc`) enables a local low-privileged process to escalate to higher execution privileges with no user interaction. The flaw spans Android 14, 15, 16, 16-QPR2, and 17, covering the full range of currently supported Android releases. Google addressed this in the September 2026 Android Security Bulletin; no public exploit code has been identified at time of analysis.
Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.
Privilege escalation in Android's ActivityStarter component (Android 14 through 16-qpr2) allows a locally-installed application with standard permissions to launch background activities outside Android's background launch restrictions, achieving full device compromise. The flaw resides in the executeRequest method of ActivityStarter.java, where a logic error fails to properly enforce the protection mechanism (CWE-693) that prevents unauthorized background activity launches. No public exploit has been identified at time of analysis; EPSS stands at 0.12% (2nd percentile), consistent with the SSVC exploitation status of none.
Local privilege escalation in Android's telephony stack allows a low-privilege app to send USSD requests without the required telephony permission, bypassing Android's permission model through a logic error in handleUssdRequest of PhoneInterfaceManager.java. Affected releases span Android 14 through 17 including the 16-QPR2 branch, with no user interaction required post-installation. USSD access can reach carrier-side services capable of triggering sensitive device operations, making a successful exploit a pathway to full device compromise.
Multi-user isolation breaks in Android's ClipboardService framework layer (CWE-284 Improper Access Control) across Android 14 through 17, enabling a locally-executed low-privileged process to cross user-profile boundaries and escalate privileges with full confidentiality, integrity, and availability impact. The logic error in setClipboardAccessNotificationsEnabledForUser fails to correctly enforce per-user access checks, allowing one user context to manipulate clipboard access notification state for other user profiles on the same device. No public exploit has been identified at time of analysis, and EPSS of 0.12% places this at the 2nd percentile for near-term exploitation probability.
Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.
Out-of-bounds write in Android's camera metadata validation logic (validate_camera_metadata_structure in camera_metadata.c) allows a local low-privileged attacker to escalate privileges to a higher-privileged context with full confidentiality, integrity, and availability impact. Affects Android 14 through 16-qpr2, patched in the September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; EPSS sits at the 2nd percentile and SSVC rates exploitation as none.
Local privilege escalation in Android 16 and 16-QPR2 allows a low-privileged app to escalate to full device control by exploiting a logic error in HostEmulationManager.java that permits unauthorized background activity launches. The flaw stems from CWE-693 (Protection Mechanism Failure) in the activity-launch gating logic, enabling an installed malicious app to bypass Android's background activity restrictions without requiring additional permissions or user interaction. No public exploit has been identified and CISA has not added this to KEV, but SSVC rates the technical impact as total given that successful exploitation yields C:H/I:H/A:H on the device.
Local privilege escalation in Android's BackgroundLaunchProcessController allows a low-privileged app or user process to launch background activities beyond its permitted scope due to a logic error in the areBackgroundActivityStartsAllowed gating function. Affected versions span Android 14 through Android 16-QPR2, covering the vast majority of modern Android devices in active use. With PR:L and UI:N, exploitation requires only a foothold as a regular user-space app - no user interaction or elevated permissions - making it a reliable post-installation escalation primitive. No public exploit exists and CISA SSVC rates exploitation as none at time of analysis.
Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.
Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.
Silent NFC payment session hijacking in Android 15 and 16 allows a locally-installed low-privilege application to exploit missing permission checks in NfcService.java, enabling unauthorized manipulation of NFC payment sessions without any user interaction. The flaw is a missing authorization gate (CWE-862) across multiple functions in the NFC service, permitting a malicious app to hijack, enable, or redirect contactless payment flows targeting the device. No public exploit has been identified and CISA SSVC rates exploitation as none, though the financial-fraud potential elevates practical risk beyond what the EPSS score of 0.11% suggests.
Local privilege escalation in Android's AppRestrictionsFragment allows a low-privileged app to gain unauthorized read/write access to private files via a confused deputy in the assertSafeToStartCustomActivity method. Affected versions span Android 14, 15, 16, 16-QPR2, and 17, making this a broad-surface vulnerability across the current Android ecosystem. With PR:L/UI:N, a malicious installed app can silently exploit this without user interaction to achieve full local C:H/I:H/A:H impact. No public exploit identified at time of analysis; EPSS is 0.11% (2nd percentile).
Local privilege escalation in Android's PaymentDefaultDialog allows an attacker with standard app-level execution to silently replace the device's default NFC payment application via a confused deputy in the component's onCreate method. Affecting Android 15, 16, 16-qpr2, and 17, the flaw is patched in the September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, and EPSS sits at 0.11%, consistent with SSVC's 'Exploitation: none' designation despite the high technical impact potential.
Tapjacking and UI overlay exploitation in Android 16-QPR2's `InstallLaunch.kt` `onCreate` method allows a locally-installed malicious application to present a deceptive interface over the package installation workflow, leading to local privilege escalation with full confidentiality, integrity, and availability impact. Fixed in Google's September 2026 Android Security Bulletin, the flaw requires no additional execution privileges and - per the CVSS vector - no user interaction beyond what occurs during the overlay setup phase. No public exploit code and no active exploitation have been identified at time of analysis; EPSS sits at 0.11% (2nd percentile).
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Out-of-bounds write (CWE-787) in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) enables arbitrary code execution in the context of the logged-in user. The attack is triggered by opening a specially crafted document, making phishing attachments and compromised file-sharing platforms viable delivery mechanisms against creative and design professionals. No public exploit identified at time of analysis, but the low attack complexity and full CIA impact across affected versions represent a meaningful and realistic risk.
Local privilege escalation in the Android kernel's IOMMU subsystem (iommu.c) allows any process with basic user-level execution to gain full kernel privileges through out-of-bounds memory read/write triggered by improper input validation across multiple functions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required, making this a reliable local privilege escalation primitive for post-compromise chains or malicious apps. Google patched this in the Android Security Bulletin for September 2026 with two upstream kernel commits; no public exploit has been identified at time of analysis.
Privilege escalation in Android's SmsController affects versions 14, 15, 16, and 16-QPR2 due to missing permission checks across multiple functions. A locally-running application with basic privileges can invoke these unguarded entry points to gain full read, write, and availability impact on the device without any user interaction. No public exploit or active KEV listing exists at time of analysis; Google addressed this in the September 2026 Android Security Bulletin.
Local privilege escalation in the Android kernel's KVM IOMMU subsystem allows a low-privileged user to gain full kernel control via a use-after-free condition in kvm_iommu_map_sg (iommu.c). The root cause is a missing permission check that enables memory to be accessed after it has been freed, allowing an unprivileged local process to achieve read/write/execute control over the kernel. No public exploit has been identified at time of analysis, but Google's September 2026 Android Security Bulletin confirms the issue and provides a kernel patch via android.googlesource.com.
Local privilege escalation in Android's MountRegistry component across Android 14, 15, 16, and 16-qpr2 allows a low-privileged process to achieve full device compromise via a buffer overflow in the forEachLine function of MountRegistry.cpp. The flaw triggers an out-of-bounds read that can corrupt adjacent memory, enabling an attacker to elevate from a sandboxed app or low-privilege process to a higher system privilege level without any user interaction. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total.
Local privilege escalation in Android 17's STMicroelectronics NCI (NFC Controller Interface) driver allows a low-privileged local process to gain full system-level control via a missing bounds check in `stpropnci_process_std()` of `stpropnci_std.cc`. The missing input validation triggers a CWE-120 buffer overflow, achieving C:H/I:H/A:H impact with no user interaction required. No public exploit has been identified at time of analysis per SSVC exploitation status 'none,' though the SSVC Technical Impact is rated 'total.'
Heap buffer overflow in Android's HEVC decoder (`ihevcd_get_tu_data_size` in `ihevcd_utils.c`) enables local privilege escalation across Android 14 through Android 17 with no additional execution privileges or user interaction required. A low-privileged attacker - such as a malicious application - can craft HEVC video input that triggers an out-of-bounds write on the heap, corrupting adjacent memory structures and ultimately gaining elevated device privileges. No public exploit code has been identified at time of analysis, and SSVC currently rates active exploitation as none, though the technical impact is classified as total.
Out-of-bounds write in Android's openLogicalChannel function across multiple telephony-related files enables local privilege escalation on Android 16 and 17 without requiring elevated permissions or user interaction. An attacker running as a low-privileged app can supply oversized input to a missing bounds check, corrupting adjacent memory and achieving full C:H/I:H/A:H system impact per CVSS. No public exploit has been identified at time of analysis; SSVC rates technical impact as total while exploitation status remains none.
Local privilege escalation in Android 16, 16-QPR2, and 17 stems from improper input validation in the AppendCommentLine function of AnnotationProcessor.cpp. A low-privileged local attacker can exploit this CWE-20 flaw without user interaction to achieve full confidentiality, integrity, and availability impact, consistent with a complete privilege escalation on the device. Google's Android Security Bulletin for September 2026 (2026-09-01) addresses this issue; the description's explicit 'supply chain risk' framing is atypical and suggests the vulnerable code participates in a build or annotation-processing pipeline where malicious input could propagate into compiled artifacts.
Heap-based buffer overflow in parseParts of PduParser.java enables local privilege escalation across Android 14 through 17 (including Android 16-QPR2). A low-privileged process on the device can trigger an out-of-bounds read via a malformed PDU, corrupting heap memory to achieve full confidentiality, integrity, and availability compromise without requiring user interaction. No public exploit code or KEV listing has been identified at time of analysis.
Local privilege escalation in Android 17 and Android 16-qpr2 stems from integer overflow vulnerabilities across multiple code locations, enabling out-of-bounds writes. A low-privileged local process or application can exploit these flaws without additional execution privileges or user interaction to gain full control over the device. No public exploit has been identified at time of analysis, and SSVC signals no current exploitation activity, but technical impact is rated total.
Local privilege escalation in Android's runtime image writer (WriteImageToDisk, runtime_image.cc) allows a low-privileged local process to tamper with files through a logic error, potentially gaining full system control. Affected versions span Android 14 through Android 17, including the Android 16-QPR2 branch, making this a broad-impact flaw across the current and future Android release train. No public exploit has been identified at time of analysis, and SSVC indicates exploitation is currently none, but the Technical Impact rating of 'total' underscores the severity if exploited.
Local privilege escalation via use-after-free in the Windows WebClient (WebDAV client) Service affects virtually every supported Windows desktop and server release, from Server 2012 through Windows 11 and Server 2025. An authenticated local attacker with standard user privileges can exploit the memory-safety flaw to achieve full SYSTEM-level control, gaining complete confidentiality, integrity, and availability over the host. No public exploit has been identified at time of analysis, and Microsoft has released patched builds for all affected versions via its standard Patch Tuesday update mechanism.
Heap-based buffer overflow in Windows Deployment Services (WDS) allows a locally authenticated low-privileged attacker to execute arbitrary code, effectively achieving local privilege escalation on affected Windows Server and Windows 10 systems. The flaw spans a wide range of Microsoft server OS versions from Windows Server 2012 through Windows Server 2025, as well as Windows 10 builds 1607 and 1809. No public exploit identified at time of analysis, but Microsoft has released patches via the standard update mechanism.
Local privilege escalation in Windows Fax Service affects a broad range of Microsoft Windows desktop and server editions, allowing a low-privileged authenticated user to achieve full system compromise through a heap-based buffer overflow. The vulnerability carries a CVSS 7.8 score with a local attack vector and requires no user interaction, making it a reliable post-exploitation escalation primitive once an attacker has any foothold on an affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Privilege escalation in Windows Installer affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025, allowing a locally authenticated low-privileged attacker to gain full SYSTEM-level control by exploiting improper validation of integrity check values (CWE-354). The CVSS vector (AV:L/PR:L) confirms local exploitation requiring only a standard user account, with no user interaction needed once access is established. No public exploit has been identified at time of analysis, but Microsoft has released patches for all affected builds.
Local privilege escalation in the Windows Spaceport.sys kernel driver (associated with Windows Subsystem for Linux / virtualization infrastructure) allows a low-privileged authenticated local user to execute arbitrary code, likely achieving SYSTEM-level access, via an out-of-bounds write condition. The vulnerability spans an exceptionally broad surface: Windows 10, Windows 11 (through 26H1), and Windows Server 2012 through 2025 are all affected. Microsoft has released patches; no public exploit or CISA KEV listing is present at time of analysis.
Type confusion (CWE-843) in the Windows Core Messaging IPC subsystem enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows 10, Windows 11, and Windows Server installations. The flaw allows an object to be accessed through an incompatible type reference, corrupting memory in a way that breaks privilege separation boundaries. Microsoft has released patches across all affected versions via MSRC; no active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in Windows Core Messaging affects a broad range of Windows 10, Windows 11, and Windows Server releases (2016 through 2025). A low-privileged local attacker can trigger the overflow through a malformed IPC message to achieve full SYSTEM-level access (C:H/I:H/A:H) without user interaction. Microsoft has released patches across all affected SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Active Directory Certificate Services (AD CS) on Windows enables an authenticated low-privileged user to gain full system control (C:H/I:H/A:H) without user interaction. The root cause is CWE-116 - improper encoding or escaping of output - within the AD CS component, which Microsoft has patched across a broad range of Windows 10 and Windows Server releases from 2012 through 2025. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this straightforward to exploit once an attacker has local access.
Heap-based buffer overflow in the Windows Audio Service (AudioSrv/audiosrv.dll) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM level on affected Windows 10, Windows 11, and Windows Server installations. The vulnerability is confirmed by Microsoft's Security Response Center (secure@microsoft.com) and affects a broad range of supported Windows releases from build 1809 through the latest 26H1 branch. Patches are available across all affected product lines. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Local privilege escalation in Windows Hello across Windows 10 and Windows 11 allows an authorized low-privileged attacker to gain full system-level control via a race condition in the authentication subsystem. The vulnerability (CWE-362) exploits improper synchronization of concurrent operations within Windows Hello, requiring only local access and low privileges but no user interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Universal Disk Format File System Driver (udfs.sys) enables local privilege escalation to SYSTEM across a broad sweep of Windows client and server versions. An authenticated low-privileged local attacker can trigger the overflow through UDFS volume parsing, achieving full confidentiality, integrity, and availability compromise of the target system (CVSS 7.8, C:H/I:H/A:H). Microsoft has released corrective security updates across all affected product lines; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows HID (Human Interface Device) class kernel driver enables local privilege escalation from a standard user account to SYSTEM-level code execution. All supported Windows 10, Windows 11, and Windows Server 2012 through 2025 builds are affected, giving this vulnerability an exceptionally broad surface across virtually every enterprise Windows fleet. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Hello across multiple Windows 10 and 11 versions allows an authorized low-privileged local attacker to gain full system control via a double-free memory corruption vulnerability (CWE-415). Affected builds span Windows 10 21H2/22H2 through Windows 11 26H1. Microsoft has released patched builds via the standard update channel. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Heap-based buffer overflow in the Windows MIDI Service Module enables a local authenticated attacker on Windows 11 to escalate privileges, with full confidentiality, integrity, and availability impact in the compromised process scope. Affected builds span three servicing tracks - 24H2, 25H2, and 26H1 - with fixed builds published by Microsoft through MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in Spaceport.sys, the Windows kernel driver for the Storage Spaces subsystem, allows a low-privileged authenticated local user to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans an exceptionally wide range of Microsoft Windows releases, from Windows Server 2012 and Windows 10 Version 1607 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected build tracks; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Kerberos implementation enables a local low-privileged attacker to escalate privileges to SYSTEM-level, achieving full confidentiality, integrity, and availability compromise of the affected host. The vulnerability spans an exceptionally wide range of Windows versions - from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1 - making the exposure surface very broad. Microsoft has released patches; no public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Local privilege escalation in Windows Error Reporting (WER) across virtually every supported Windows platform exploits an absolute path traversal flaw (CWE-36) to elevate a standard authenticated user to full system control. An attacker with a low-privilege local session can supply a crafted absolute path to the WER subsystem, escaping its intended directory and accessing or overwriting privileged system resources, achieving complete confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:L). No active exploitation has been confirmed by CISA KEV and no public proof-of-concept has been identified at time of analysis, but the extremely wide affected product surface spanning Windows 10 through Windows 11 and Server 2012 through Server 2025 makes this a high-urgency patching item.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables local privilege escalation to SYSTEM across a broad range of Windows 10, 11, and Windows Server versions. An attacker with a standard low-privilege local account can trigger the overflow without user interaction, achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches for all affected product lines and no active exploitation has been confirmed at time of analysis.
Heap-based buffer overflow in the Windows Universal Disk Format File System (UDFS) kernel driver enables a low-privileged local user to escalate privileges to SYSTEM across a broad swath of Windows releases spanning Server 2012 through Windows 11 26H1 and Windows Server 2025. The flaw resides in the filesystem driver responsible for reading UDF-formatted volumes (optical media, some removable storage), and exploitation requires only a standard user account with no user interaction. Microsoft has released patches through the update guide; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Search Component exposes virtually the entire Windows ecosystem - from legacy Server 2012 to Windows 11 26H1 - to full system compromise by any low-privileged local user. The flaw stems from an incorrect type conversion or cast (CWE-704) within the Search Component, allowing an attacker with a standard user session to escalate to SYSTEM-level privileges without user interaction. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches covering all affected build lines.