EUVD-2026-115573
GHSA-f82g-54qp-28w8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun unprivileged code on device
-
DeliveryConcurrently invoke vulnerable paths
-
ExploitWin race to trigger use-after-free
-
ExecutionReclaim freed object with controlled data
-
PersistCorrupt privileged state
-
ImpactEscalate privileges on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local vector: the attacker must already be able to execute code on the target device (e.g., a locally installed, unprivileged app), consistent with AV:L and PR:N. Exploitation requires winning a race condition to trigger the use-after-free, which generally demands repeated attempts and precise timing and makes success non-deterministic. No user interaction is required (UI:N) and no special configuration is named - the flaw resides in standard platform code paths ('multiple locations,' not specified). Affected builds are Android 16, Android 16-qpr2, and Android 17; the vector is local, not network-reachable, despite the description's 'remote' phrasing, which limits realistic exposure to attackers with existing on-device code execution. |
| Impact | Signals are moderately consistent but incomplete. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4 HIGH) indicates a local attack vector with no privileges or user interaction and full CIA impact - consistent with a local privilege-escalation primitive reachable by any code already running on the device. Note a wording conflict: the description calls this 'remote escalation of privilege,' but the CVSS vector is AV:L (local), which is typical Android-bulletin phrasing where 'remote' contrasts with 'physical/proximal' rather than meaning network-reachable - treat this as local, not network, exploitation pending vendor clarification. The vuln.today decision label is 'this_week' (elevated but not act_now/emergency). No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no SSVC fields supplied. No POC or exploit reference is present in the input. Overall this is a genuinely serious memory-safety EoP in an ubiquitous platform, but with no evidence of active exploitation or public exploit code, and a local-only vector, it reads as a prompt-patch (within normal Android monthly cadence / 'this_week') rather than a drop-everything emergency. |
| Exploit ScenarioDerived | A malicious or compromised app already running on the device repeatedly triggers the vulnerable code paths to win a race condition, causing a use-after-free on a freed kernel/system object. By controlling the reallocated memory it corrupts state to escalate from an unprivileged context to higher privileges. No user interaction is required; no public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Local privilege escalation in Google Android 16, 16-qpr2, and 17 is caused by a use-after-free race condition in multiple platform code paths. An attacker who can already execute code on the device at low privilege can attempt to win the race and gain elevated privileges without user interaction; the assessed vector is local with high attack complexity, and reliable success is non-deterministic. No public exploit code or confirmed active exploitation is identified in the supplied data, and the November 2026 Android security bulletin is the vendor reference.
RemediationAI
Apply the Android security bulletin updates referenced at https://source.android.com/docs/security/bulletin/2026/2026-11-01 for Android 16, Android 16-qpr2, and Android 17. The supplied data does not list exact patch levels or build numbers, so device owners and fleet administrators should follow the bulletin's device-specific update guidance. No workaround or compensating configuration is described in the available sources; because the issue resides in standard platform code paths across multiple locations, updating is the documented remediation path. The race condition makes exploitation non-deterministic, but it does not remove the need to apply the vendor update.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-416, use-after-free, in Android platform code. The supplied sources state that the issue exists in multiple locations and is triggered through a race condition, meaning memory can be freed and then referenced while another execution path still holds a pointer to it, potentially enabling memory corruption and privilege escalation. The affected platform spans Android 16, Android 16-qpr2, and Android 17, identified by the CPE cpe:2.3:a:google:android. The independent assessment rates this as AV:L/AC:H/PR:L/UI:N, so exposure requires an attacker who can already execute code locally on the device, while winning the race requires repeated attempts and precise timing. No user interaction is required, and the specific vulnerable components within the platform are not named in the available sources. The description's phrasing about remote escalation is not supported by the assessed local vector; realistic exposure is limited to attackers with existing on-device code execution.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local on-device code is needed (AV:L, PR:L for a running app), the described race condition makes the trigger timing-dependent (AC:H), and a UAF EoP plausibly yields full CIA impact.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
A high-severity local privilege escalation vulnerability in Google Android 16, 16-qpr2, and 17 (CVE-2026-55275) could allow a malicious app already installed on a device to gain elevated system privileges. This puts enterprise Android devices at risk of compromise if users download untrusted applications, potentially leading to data theft or further network compromise. Leadership should prioritize mitigation given the lack of a vendor patch and the potential for exploitation by insiders or malicious apps.
No vendor-released patch identified at time of analysis. Implement application allowlisting, enforce device encryption, restrict installation of apps from unknown sources, and deploy endpoint detection and response (EDR) for mobile devices to detect privilege escalation attempts. Monitor for anomalous behavior using mobile threat defense tools.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB