Android CVE-2026-49918

The attacker must already have local code execution on the target device with at minimum a low-privileged user or app account (PR:L per CVSS AV:L/PR:L). No user interaction is required once local access exists, and no special non-default Android configuration is needed - the vulnerable code paths are present in standard builds of Android 16-QPR2 and Android 17. Remote exploitation is not applicable; the attacker must first achieve a local foothold through a malicious app, physical access, or a separate initial-access vulnerability. The primary factor limiting real-world risk is this local access prerequisite (AV:L), which rules out unauthenticated remote exploitation entirely.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) credibly reflects the attack profile: local access with low user privileges, low complexity, no user interaction required, and total CIA impact consistent with full privilege escalation to root. EPSS at 0.12% (2nd percentile) is markedly low, indicating no observed exploitation pattern in the wild at time of scoring. SSVC corroborates this - exploitation status is 'none,' the attack is not automatable (requiring local access), yet technical impact is rated 'total,' meaning successful exploitation yields complete system compromise. The divergence between low EPSS and SSVC 'total' impact is characteristic of an unweaponized-but-severe LPE flaw: even a mid-sized municipal IT team in kalisz managing a fleet of Android enterprise devices should treat this as urgent patching priority given that exploitation requires only a low-privileged foothold. No CISA KEV listing exists, and no POC has been identified, so the near-term exploitation probability is low absent further development. The primary real-world limiting factor is the AV:L requirement - the attacker must already have local code execution, which significantly narrows the threat model compared to remote-exploitable vulnerabilities.

An attacker with an installed low-privileged application or local shell access on an Android 16-QPR2 or 17 device calls a vulnerable system function with crafted input that triggers an integer overflow, causing a subsequent write to exceed the allocated buffer and corrupt adjacent memory. By controlling the overflow offset and payload, the attacker overwrites a privilege-related kernel structure or function pointer to redirect execution to attacker-controlled code running at elevated privilege. No public exploit code has been identified, making this scenario currently theoretical.