What is the CVSS score of CVE-2026-28580?

CVE-2026-28580 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2026-28580?

Google Android 16 and 16-qpr2 devices contain a privilege escalation vulnerability (CVE-2026-28580) that allows attackers with initial device access to gain full administrative control, creating…

How to fix or mitigate CVE-2026-28580?

24 hours: Complete inventory of all enterprise Google Android 16 and 16-qpr2 devices; classify by data sensitivity and user role. 7 days: Deploy mobile device management (MDM) controls to disable sideloading, restrict app installation to approved sources, disable developer options, and enforce app permission restrictions; enable runtime monitoring for privilege escalation activity. 30 days: Execute technical migration plan to Android 17+ or newer; if delayed, document risk acceptance and implement comprehensive compensating control framework with enhanced SIEM logging.

Android CVE-2026-28580

EUVD-2026-33813 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-01 google_android

GHSA-vvwc-gw3f-hjhm

Privilege Escalation Buffer Overflow

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 00:28 vuln.today

CVSS changed

Jun 01, 2026 - 23:22 NVD

7.8 (HIGH)

CVE Published

Jun 01, 2026 - 21:14 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 01, 2026 - 21:14 nvd

HIGH 7.8

DescriptionCVE.org

In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android 16 and 16-qpr2 allows an attacker with low-privilege code execution on the device to gain elevated privileges by exploiting an incorrect bounds check that causes a desync in persistence logic across multiple functions. Categorized as CWE-120 buffer overflow with high confidentiality, integrity, and availability impact, the flaw requires no user interaction and has no public exploit identified at time of analysis. CISA SSVC scoring indicates no observed exploitation but rates technical impact as total.

Technical ContextAI

The vulnerability is a CWE-120 classic buffer copy without checking size of input (buffer overflow) located in the Android platform's persistence-handling code paths. According to the description, multiple functions perform an incorrect bounds check that produces a desync condition in persistence state, which a local attacker can leverage to corrupt memory or state used in privilege decisions. The CPE string cpe:2.3:a:google:android scopes the issue to the Android operating system itself rather than a specific OEM layer, and the tag 'Buffer Overflow' aligns directly with the CWE root cause class.

RemediationAI

Patch available per vendor advisory: apply the Android Security Patch Level 2026-06-01 or later as published in the June 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-06-01); exact fix version/build number was not provided in the input data, so verify against the SPL string reported under Settings > About phone after update. On devices where the OEM has not yet shipped the June 2026 SPL, compensating controls include restricting sideloading by disabling 'Install unknown apps' for all sources, enforcing Google Play Protect, and using MDM policies to block installation of non-vetted applications - these reduce the likelihood that an attacker can obtain the local foothold needed to chain this LPE, at the cost of constraining user app choice and developer-mode workflows.