Android CVE-2026-28583

Exploitation requires local code execution on the target Android device with at minimum a standard (low-privilege) application context, as indicated by CVSS PR:L and AV:L. No user interaction is required once the attacker's code is running on device. The vulnerable code path (validate_camera_metadata_structure) must be reachable from the attacker's execution context, which is achievable for apps with camera permission or via IPC to the camera server process. No special non-default configuration is required - the camera subsystem is present in all standard Android builds. Limiting factors include the requirement for initial local code execution (the attacker must already have an app running on the device), and SSVC automatable=no indicating the exploit cannot be trivially replicated at scale without a local foothold.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local, low-complexity privilege escalation with full CIA impact. Real-world exploitation probability is very low: EPSS at 0.12% (2nd percentile) and SSVC exploitation=none both indicate no observed in-the-wild activity. SSVC automatable=no reinforces that this cannot be mass-deployed without some local foothold. The SSVC technical impact of 'total' aligns with the C:H/I:H/A:H CVSS triad, confirming that successful exploitation would give an attacker near-complete control over the affected process or device security boundary. This pattern - high CVSS, low EPSS, no KEV, no POC - characterizes an unexercised local LPE that requires an attacker already on the device. Priority should be driven by device management maturity: unmanaged consumer Android fleets with delayed patching are at higher residual risk than managed enterprise fleets with monthly patch cycles.

A malicious or compromised application installed on an Android device crafts a deliberately malformed camera metadata structure and submits it to the camera framework, triggering the logical error in validate_camera_metadata_structure. The resulting out-of-bounds write corrupts adjacent memory in the camera server or a higher-privileged process, allowing the attacker to redirect execution and gain elevated privileges - potentially camera server or system-level access. No public proof-of-concept exists at time of analysis.