EUVD-2026-115564
GHSA-x4cj-r3mm-m29r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app or crafted input locally
-
DeliveryInduce required user interaction
-
ExploitSupply malformed USSD/MMI string
-
ExecutionBypass improper input validation in MmiUtils.java
-
ImpactAchieve local privilege escalation with total impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires local access to the device and user interaction (AV:L/UI:R): an attacker-controlled app or supplied input must reach the USSD/MMI handling in MmiUtils.java, and the user must be induced to perform the triggering action. The specific prerequisite is the processing of crafted USSD/MMI codes through the improperly-validated functions in MmiUtils.java; no special execution privileges are needed by the triggering code (PR:N). Limiting factors: it is not remotely exploitable without local presence, the user must take an action, and only Android 14 through 17 (including 16-qpr2) are stated as affected. The exact configuration or feature state needed to reach the vulnerable path is not described in the available sources. |
| Impact | Signals point to a genuine but non-urgent, locally-scoped issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H = 7.8 High) describes a local vulnerability that requires user interaction but no prior privileges, yielding total impact to confidentiality, integrity and availability - consistent with the SSVC Technical Impact of 'total'. However, the exploitation-side signals are uniformly low: SSVC Exploitation is 'none' (no observed activity), SSVC Automatable is 'no', EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and no public exploit is referenced. These signals agree with each other - a severe-if-exploited but not-currently-exploited local privilege-escalation bug. The vuln.today 'this_week' decision label reflects routine Android-bulletin patch cadence, not emergency pressure. Note the tension between the CVSS PR:N ('no privileges') and the fact that this is a local EoP requiring user interaction: PR:N here means the triggering app/input needs no special execution privileges, not that it is remotely reachable - AV:L confirms local access is required. The 'RCE' tag conflicts with the description, which states local escalation of privilege, not remote code execution; treat the RCE label as unreliable. Bottom line: a real priority to patch on the normal Android monthly cycle, but not an emergency given no exploitation evidence and low automatability. |
| Exploit ScenarioDerived | A user is induced to install or interact with a malicious or compromised app on an affected Android device; the app supplies crafted USSD/MMI input that improper validation in MmiUtils.java fails to reject. Because exploitation requires local presence and user interaction (AV:L/UI:R) and no special execution privileges, the malformed input is processed with elevated handling, escalating the attacker's privileges on the device. No public exploit code is identified at time of analysis, and the precise trigger within MmiUtils.java is not detailed in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Improper input validation in Android's MMI/USSD handling code (MmiUtils.java) allows a local attacker to escalate privileges by getting crafted USSD/MMI codes processed on the device. Android 14, 15, 16, 16-QPR2 and 17 are listed as affected, and successful exploitation yields high confidentiality, integrity and availability impact, though it requires local presence and a user action (AV:L/PR:N/UI:R, CVSS 7.8). No public exploit has been identified at time of analysis, SSVC records exploitation as none and non-automatable, and EPSS is only 0.11% (1st percentile), so the practical threat is locally scoped rather than a mass-exploitation risk.
RemediationAI
Vendor-released remediation is referenced through the Android security bulletin at https://source.android.com/docs/security/bulletin/2026/2026-11-01, which carries the platform fix for Android 14, 15, 16, 16-QPR2 and 17; apply the bulletin's patch level to affected devices and treat the bulletin as the authoritative source for the exact build identifiers, which are not stated in the input data. No discrete fix version string is provided in the available sources, so the bulletin's November 2026 patch level is the actionable target rather than a named build. Because exploitation requires local presence and a user action (AV:L/UI:R) with the attacker-controlled input reaching USSD/MMI handling in MmiUtils.java, the assessed limiting factors are physical/local presence and user-induced triggering; the sources do not describe a supported configuration switch or feature toggle that disables the vulnerable path, so no verified workaround can be recommended beyond applying the vendor patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-20 improper input validation defect in MmiUtils.java, part of Android's telephony/framework handling of MMI and USSD codes - the short code strings used for supplementary services and service-provider interactions. Because those code strings are parsed and acted upon by privileged telephony components, insufficient validation lets a locally supplied or app-supplied code reach execution paths it should not. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: the attacker needs local presence on the device, needs no execution privileges for the triggering code (PR:N), but must induce the user to perform the triggering action (UI:R). Some feeds tag this as RCE, but the authoritative assessment is local escalation of privilege, not remote code execution. The available sources do not describe the exact trigger, the feature state, or the specific configuration required to reach the vulnerable path, and they do not distinguish per-version behaviour beyond listing Android 14, 15, 16, 16-QPR2 and 17 as affected (CPE cpe:2.3:a:google:android).
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local USSD/MMI path (AV:L) needing user interaction (UI:R) but no privileges (PR:N); improper input validation yields total device impact (C/I/A:H), scope unchanged.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Executive ViewAI
CVE-2026-49934 is a high-severity input validation flaw in Android's MMI/USSD handling that enables a local attacker to gain elevated privileges through crafted USSD/MMI codes. This affects all Android 14, 15, 16, 16-QPR2 and 17 devices, but requires local access and user interaction, limiting the attack surface to scenarios involving physical or social engineering access. Leadership should prioritize this for mobile fleet remediation due to the sensitive data and system integrity at risk, despite the low likelihood of mass exploitation.
No vendor-released patch identified at time of analysis; enforce user awareness training, restrict USSD/MMI execution via device management policies, and limit local access to sensitive devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB