Android libufdt CVE-2026-55266

Exploitation requires the attacker to already have local, low-privileged execution on the affected Android device (PR:L) - for example, a malicious installed app or a process able to feed input into the libufdt device-tree parsing path that reaches qsort in libufdt_sysdeps_vendor.c. No user interaction is needed (UI:N) and no additional execution privileges are required beyond the initial foothold. Limiting factors: the attack is local only (not remote/network reachable), it depends on the vulnerable libufdt code path being invoked with attacker-influenced input, and it is constrained to Android versions 14 through 17 (including 16-qpr2); it cannot be triggered by an unauthenticated remote attacker.

All signals point to a genuine but locally-scoped risk rather than an internet-facing emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local-only vulnerability requiring some pre-existing privileges (PR:L) but low complexity and no user interaction, yielding full CIA impact via local escalation of privilege - consistent with the description. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the input, so exploitation remains theoretical: no public exploit identified at time of analysis. No SSVC decision data was supplied. The key tension is that CWE-400 (uncontrolled resource consumption) typically implies denial of service, yet the description and CVSS claim an out-of-bounds WRITE leading to privilege escalation; the 'Denial Of Service' tag reflects the CWE while the real impact is memory corruption / EoP - treat the CWE as a loose classification and the EoP as the operative outcome. Because exploitation requires local code execution already on the device (PR:L), this is a privilege-escalation building block (e.g., part of an exploit chain from a malicious app to higher privilege), not a remotely weaponizable flaw. Priority is moderate: patch via the normal Android monthly cycle; it is not a drop-everything issue absent evidence of active exploitation.

A malicious or compromised low-privileged Android app, or a process that can supply a crafted device-tree blob, triggers the flawed qsort path in libufdt_sysdeps_vendor.c, exhausting resources to force an out-of-bounds write and corrupt memory. The attacker leverages this corruption to escalate from their existing low privilege to a higher-privileged context, with no user interaction required. No public exploit code is identified at time of analysis.