EUVD-2026-40052
GHSA-xf9v-h779-xxhr
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Local IPC abuse from an existing low-privileged process (AV:L/PR:L), low complexity, user interaction needed, crossing into the privileged service (S:C) with high availability impact.
Primary rating from Vendor (OPPO).
CVSS VectorVendor: OPPO
Lifecycle Timeline
1DescriptionCVE.org
Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.
AnalysisAI
Local privilege escalation in OPPO's O+ Connect arises because its inter-process communication (IPC) service accepts client connections without authenticating them, letting any external application on the same device invoke privileged operations through the IPC channel. With CVSS 7.3 (scope-changed, high availability impact) and CWE-266 incorrect privilege assignment, a low-privileged local process can perform sensitive actions it should not be authorized for. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
O+ Connect is OPPO's cross-device connectivity software (phone-to-PC/device linking and file transfer). The flaw lives in its IPC service - a local endpoint other processes use to request actions from the privileged O+ Connect component. Because the service performs no client authentication or authorization check, it cannot distinguish a legitimate first-party caller from an arbitrary local application. This is a textbook CWE-266 (Incorrect Privilege Assignment): the IPC interface effectively grants its own privilege level to any caller, so a low-privileged client inherits the service's elevated capabilities. The CVSS scope change (S:C) reflects that the impact crosses the trust boundary from the calling process into the more privileged service domain.
RemediationAI
Apply the update referenced in OPPO's security advisory at https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2070415238859333632 - patch available per vendor advisory, though no exact fixed version was provided in the input, so confirm the specific build with OPPO before deploying. Because exploitation requires a local process abusing the unauthenticated IPC service, effective compensating controls until patched include uninstalling or disabling O+ Connect on devices that do not need cross-device linking (trade-off: loses the connectivity feature entirely), restricting which user accounts can run untrusted local software, and applying application allowlisting to prevent unknown processes from launching and connecting to the IPC endpoint (trade-off: administrative overhead maintaining the allowlist). Do not rely on network controls, as the attack vector is local rather than network-based.
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today