EUVD-2026-37217
GHSA-h92c-hcr8-p8xx
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Local physical access to a reset device (AV:L), no privileges or interaction consumed by the flawed wipe logic (PR:N/UI:N), and only partial residual-data disclosure (C:L, I/A:N).
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
A logic error in the PostWipeData routine of the Android recovery UI (recovery_ui.cpp) can leave residual user data intact and readable after a factory reset has been performed, yielding a low-impact local information disclosure (CVSS 4.0, C:L). The bug is not remotely reachable and only becomes exploitable when an attacker gains physical possession of a device that has already been reset - for example a resold, returned, RMA'd, or discarded handset - so real-world exposure is confined to organizations and users who relinquish hardware that previously held sensitive data. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; EPSS is 0.07% (0th percentile), SSVC records Exploitation: none / Automatable: no, and the vendor classifies the confidentiality impact as partial, all of which support a low-priority, patching-cycle remediation.
Technical ContextAI
The flaw lives in AOSP's recovery_ui.cpp, the UI and action layer of the Android recovery environment that executes the user-initiated factory reset and invokes the data wipe path (PostWipeData). Root cause is mapped to CWE-1188 (Insecure Default Initialization of Resource): the wipe logic does not correctly handle or clear the target data resource, so a resource that should be fully reinitialized after the reset instead retains prior contents. This is a logic/ordering defect rather than a memory-safety bug, which is why it produces a persistence-of-data condition with only low confidentiality impact (S:U, C:L, I:N, A:N) rather than code execution. The CVSS vector (AV:L/AC:L/PR:N/UI:N) confirms the attack is local, requires no additional execution privileges, and needs no user interaction beyond the already-completed reset, but it carries no default remote-network exposure. The affected asset is identified by the wildcard CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, with the disclosure attributed to Google_Devices and routed through the Pixel security bulletin process; ENISA's EUVD record (EUVD-2026-37217) lists the affected footprint as "Android Android kernel," indicating the issue is tracked against Android platform builds rather than a single app. CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) corroborates that this is a manual, physical-access-dependent condition unsuitable for mass exploitation.
RemediationAI
The primary fix is to install the updated Android/Pixel build published in the Google security bulletin for 2026-06-01 (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01), which contains the corrected PostWipeData recovery logic; the bulletin is the authoritative source for the exact patched build ID, and the specific fix version is not stated in the provided data, so verify the build string against the bulletin before treating a device as remediated. Until a device is confirmed patched, treat an ordinary factory reset as insufficient for sanitizing hardware that held sensitive data, and apply custody-based compensating controls: retain physical control of devices rather than reselling, returning, or discarding them; route decommissioned handsets only through vendor trade-in/RMA programs that perform verified data destruction; and store pre-decommission devices in physically secured locations with restricted access. Enabling and verifying full-disk/file-based encryption provides a partial mitigation, because residual data at rest remains bound to keys held in hardware-backed storage and becomes unreadable if those keys are destroyed - but the trade-off is that this protection is only as strong as the key-destruction step, which is part of the same wipe flow that is defective here, so it cannot be relied upon alone. There is no applicable network-side control such as port blocking or endpoint restriction, since the attack vector is strictly local and post-reset physical access; the residual risk must be managed through device custody and prompt patching.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today