EUVD-2026-37567Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryInvoke unguarded SettingsLib API
-
ExploitBypass missing permission check
-
ExecutionGain system-level privileges
-
ImpactAbuse settings/account/network state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have local code execution on the Android device - typically via an installed app - that can reach the SettingsLib code path containing the missing permission check; no user interaction and no additional execution privileges are required once the app runs. Exploitation is limited to devices running an Android version/patch level prior to the Android 17 bulletin fix and to the specific SettingsLib branch with the logic error. Note: the supplied CVSS 4.0 vector lists AV:N (network), which contradicts the description's 'local' wording; defenders should treat this as a local-app-to-system escalation pending vendor clarification. |
| Impact | Signals are sharply conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA/SC/SI/SA all High) scores 10.0 and implies an unauthenticated network-reachable, scope-changing compromise, but the official description explicitly says 'local escalation of privilege,' which is consistent with an installed-app to system-privilege jump and would normally be AV:L. This is a material discrepancy - verify with Google's Android Security Bulletin before treating the CVE as remotely reachable. There is no EPSS data, no KEV listing, and no public exploit identified at time of analysis, so real-world risk today appears to be the standard Android LPE pattern: a malicious or compromised app on the device abusing the missing check. Even at the more conservative local interpretation, the Privilege Escalation tag and lack of required user interaction make this a high-priority monthly-bulletin fix for any Android fleet. |
| Exploit ScenarioDerived | A malicious app installed on the device (e.g., sideloaded or delivered via a trojanized Play listing) silently invokes the unguarded SettingsLib code path and obtains system-level privileges without prompting the user, then pivots to read protected settings, modify network/account state, or stage further on-device compromise. No public PoC is identified at time of analysis, but the absence of required user interaction makes such an app highly stealthy once installed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Local privilege escalation in Android's SettingsLib component stems from a missing permission check caused by a logic error, allowing on-device attackers to elevate privileges without user interaction or additional execution rights. No public exploit identified at time of analysis, and the issue is addressed in the Android Security Bulletin for Android 17. The CVSS 4.0 vector supplied (AV:N) conflicts with the description's 'local escalation' wording and should be treated as a discrepancy.
RemediationAI
Patch available per vendor advisory - apply the Android Security Bulletin update referenced at https://source.android.com/docs/security/bulletin/android-17 by moving devices to the security patch level that includes the SettingsLib fix; exact fix version is not enumerated in the input data and should be read from the bulletin entry for CVE-2026-0071. On managed fleets, push the OEM update that incorporates this Android security patch level as soon as carriers/vendors ship it. As a compensating control while waiting on OEM rollout, restrict sideloading via MDM (Play Protect enforcement, block unknown sources) and limit installation of untrusted apps, since exploitation realistically requires an attacker-controlled app on the device; this does not remove the flaw but shrinks the attack surface at the cost of reduced user app flexibility.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SettingsLib is a shared Android framework library (packaged in system_server and used by the Settings app and other system UI surfaces) that exposes helpers for managing system, network, Bluetooth, accounts, and user settings. Because it runs inside privileged system processes, any caller-side helper that omits a permission gate can be reached by lower-privileged apps and used to invoke functionality reserved for the system or signature-protected callers. The root cause is a logic error in the permission-check path - functionally a CWE-862 (Missing Authorization) class flaw - where a code branch reaches privileged behavior without first validating the caller. The single CPE (cpe:2.3:a:google:android) scopes this to the Android platform itself rather than a specific OEM fork.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description states local EoP with no UI; a low-privilege app is the realistic caller, so AV:L/PR:L/UI:N, yielding full system C/I/A impact.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
DescriptionCVE.org
In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A critical privilege escalation vulnerability in Android's SettingsLib component allows local attackers to bypass permission controls and gain elevated privileges without additional interaction. Organizations managing Android devices through BYOD programs and corporate mobile deployments face elevated risk of unauthorized access to sensitive data and circumvention of device security controls.
Apply vendor patch: upgrade to Android 17
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB