Which versions of Android SettingsLib are affected by CVE-2026-0071?

A critical privilege escalation vulnerability in Android's SettingsLib component allows local attackers to bypass permission controls and gain elevated privileges without additional interaction.

How to fix or mitigate CVE-2026-0071?

Within 24 hours: Inventory organizational Android devices and audit current OS versions. Within 7 days: Develop upgrade testing plan and procedures to Android 17 across device management platforms. Within 30 days: Begin staged rollout of Android 17 to all managed Android devices; communicate mandatory upgrade requirements to BYOD users.

Android SettingsLib CVE-2026-0071

Q: What is the CVSS score of CVE-2026-0071?

CVE-2026-0071 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37567 CRITICAL

Missing Authorization (CWE-862)

2026-06-17 google_android

Authentication Bypass Privilege Escalation Google

10.0

CVSS 4.0 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Description states local EoP with no UI; a low-privilege app is the realistic caller, so AV:L/PR:L/UI:N, yielding full system C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:28 vuln.today

CVE Published

Jun 17, 2026 - 07:09 cve.org

CRITICAL 10.0

DescriptionCVE.org

In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Android's SettingsLib component stems from a missing permission check caused by a logic error, allowing on-device attackers to elevate privileges without user interaction or additional execution rights. No public exploit identified at time of analysis, and the issue is addressed in the Android Security Bulletin for Android 17. The CVSS 4.0 vector supplied (AV:N) conflicts with the description's 'local escalation' wording and should be treated as a discrepancy.

Technical ContextAI

SettingsLib is a shared Android framework library (packaged in system_server and used by the Settings app and other system UI surfaces) that exposes helpers for managing system, network, Bluetooth, accounts, and user settings. Because it runs inside privileged system processes, any caller-side helper that omits a permission gate can be reached by lower-privileged apps and used to invoke functionality reserved for the system or signature-protected callers. The root cause is a logic error in the permission-check path - functionally a CWE-862 (Missing Authorization) class flaw - where a code branch reaches privileged behavior without first validating the caller. The single CPE (cpe:2.3:a:google:android) scopes this to the Android platform itself rather than a specific OEM fork.

RemediationAI

Patch available per vendor advisory - apply the Android Security Bulletin update referenced at https://source.android.com/docs/security/bulletin/android-17 by moving devices to the security patch level that includes the SettingsLib fix; exact fix version is not enumerated in the input data and should be read from the bulletin entry for CVE-2026-0071. On managed fleets, push the OEM update that incorporates this Android security patch level as soon as carriers/vendors ship it. As a compensating control while waiting on OEM rollout, restrict sideloading via MDM (Play Protect enforcement, block unknown sources) and limit installation of untrusted apps, since exploitation realistically requires an attacker-controlled app on the device; this does not remove the flaw but shrinks the attack surface at the cost of reduced user app flexibility.