AGL app-framework-binder CVE-2026-37525

Requires local access to an AGL system running afb-daemon through v19.90.0 with low-privilege user credentials. Attacker must have the ability to send JSON-formatted requests to the afb-daemon supervision interface, typically available to local users in standard AGL deployments. Exploitation depends on the presence of registered APIs that fail to safely handle NULL credential contexts in their authorization logic - APIs implementing robust NULL-checking that explicitly reject NULL credentials are not vulnerable to privilege escalation despite the credential nullification. The supervision Do command interface must be accessible to the attacker's user context, which is the default configuration in many AGL deployments. Network-based remote exploitation requires prior compromise to achieve local system access (AV:L). The vulnerability does not require non-default configurations or specific optional features to be enabled.

CVSS 7.8 (High) reflects local attack vector requiring low privileges with high confidentiality, integrity, and availability impact. The AV:L/AC:L/PR:L vector indicates attackers need local system access and standard user credentials, reducing remote internet-scale exploitation risk but creating significant concern for multi-user automotive systems or compromised in-vehicle networks. The attack complexity is low with no user interaction required, enabling reliable exploitation once local access is achieved. No EPSS score is available for risk probability assessment, and CISA KEV status shows no active exploitation confirmed. However, the automotive context elevates real-world risk beyond the raw CVSS score - AGL powers in-vehicle infotainment and telematics systems where privilege escalation could enable unauthorized vehicle control, data exfiltration of driver information, or safety system manipulation. The vulnerability affects all versions through v19.90.0 with the flaw present since 2018, suggesting widespread deployment in automotive products with long support lifecycles. Primary risk is to automotive OEMs and tier-1 suppliers using AGL in production vehicles. The lack of public POC and exploitation evidence suggests theoretical risk, but the clear technical details in the description make exploit development straightforward for skilled attackers with automotive domain knowledge.

An attacker with standard user access to an AGL-based automotive infotainment system crafts a JSON request to the supervision Do command, specifying a privileged API endpoint in the 'api' parameter and administrative operation in the 'verb' parameter. The afb-daemon processes the supervision call, nullifies the credential context, then dispatches the attacker-controlled API call with NULL credentials. The target API's authorization check evaluates the NULL credential as a privileged or default-allow state, granting access to restricted vehicle data, system configuration changes, or control interfaces that should require administrative privileges.