EUVD-2026-74019
GHSA-457m-9pvq-cj9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on target Android device
-
DeliveryInvoke openLogicalChannel with crafted oversized input
-
ExploitMissing bounds check triggers out-of-bounds write into adjacent memory
-
ExecutionCorrupt telephony subsystem memory structures
-
ImpactEscalate from low-privileged app context to elevated system privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have code execution on the target device at a low privilege level (PR:L), achievable via a malicious application installed through any means - sideloading, third-party stores, or social engineering. No additional Android permissions beyond basic app execution are described as required. Affected devices must be running Android 16-QPR2, Android 16, or Android 17 without the September 2026 security patch applied. Exploitation is not remotely automatable without prior local access. The scope is unchanged (S:U), so the exploit does not inherently break out to affect other devices or services. Devices already patched to the 2026-09-01 Android security patch level are not affected. |
| Impact | The provided CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector yields a 7.8 (High), reflecting low-complexity local exploitation requiring only standard app-level privileges. SSVC rates exploitation as none (no observed active exploitation), not automatable (local device access is required), and technical impact as total - meaning a successful exploit fully compromises the device. These signals are internally consistent: the vulnerability has a wide potential impact if exploited but the local attack vector limits opportunistic mass exploitation. Android 16 and 17 are current platforms with a massive global footprint, meaning even local-only exploitation carries significant aggregate risk across the installed base. EPSS data is not available in the provided inputs. No KEV listing and no POC are confirmed, which aligns with SSVC's none exploitation status. Real-world priority should be assessed by device fleet operators who cannot enforce rapid patch uptake - this is a meaningful LPE for any managed Android fleet. |
| Exploit ScenarioDerived | A threat actor publishes a malicious Android application that, once installed on an Android 16 or 17 device, silently invokes openLogicalChannel with a crafted payload exceeding the internal buffer boundary. The missing bounds check allows the write to overflow into adjacent memory structures within the telephony subsystem process, enabling the attacker to elevate from the low-privileged app sandbox to a higher system privilege level. No user interaction is required beyond the initial app installation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Out-of-bounds write in Android's openLogicalChannel function across multiple telephony-related files enables local privilege escalation on Android 16 and 17 without requiring elevated permissions or user interaction. An attacker running as a low-privileged app can supply oversized input to a missing bounds check, corrupting adjacent memory and achieving full C:H/I:H/A:H system impact per CVSS. No public exploit has been identified at time of analysis; SSVC rates technical impact as total while exploitation status remains none.
RemediationAI
Apply the September 2026 Android Security Bulletin patches; devices updated to the 2026-09-01 security patch level should receive the fix for CVE-2026-55285. Details and OEM-specific patch timelines are available at https://source.android.com/docs/security/bulletin/2026/2026-09-01. Until devices are patched, enterprise administrators should enforce app allowlisting via Mobile Device Management (MDM) to prevent installation of untrusted applications, which is the primary delivery vector for this local privilege escalation. Disabling developer options and ADB access on managed devices further limits the surface for local exploitation. Note that compensating controls do not eliminate the vulnerability - only the September 2026 patch level resolves the underlying missing bounds check.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The openLogicalChannel function is part of Android's telephony and UICC (Universal Integrated Circuit Card) subsystem, used for opening ISO 7816-4 logical channels to communicate with SIM/eSIM cards. The vulnerability spans multiple source files within this subsystem, suggesting the missing bounds check is applied to a shared input handling path. CWE-120 (Buffer Copy without Checking Size of Input) identifies the root cause as a classic unbounded memory copy - caller-supplied data is written into a fixed-size buffer without first verifying the input length fits within the destination, creating a controlled out-of-bounds write primitive. Affected platforms confirmed from EUVD are Android 16-QPR2, Android 16, and Android 17, all current production releases from Google. The reporter is security@android.com, Google's internal Android security team.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local execution with low-privilege app context required; no user interaction; full CIA impact on the vulnerable device without scope change.
Primary rating from Vendor (android).
CVSS VectorVendor: android
DescriptionCVE.org
In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android versions 16 and 17 contain a memory corruption flaw in telephony functions that allows locally-installed applications to escalate privileges and achieve complete system access without requiring additional user interaction. This directly impacts organizations deploying these Android versions, as any installed application-whether malicious or compromised-could potentially access sensitive corporate data and compromise device integrity.
No vendor-released patch identified at time of analysis. Interim mitigations include: enforcing MDM policies to restrict third-party app installation to verified enterprise application stores, disabling application sideloading across all devices, restricting app-level permissions through device management controls, implementing network segmentation to limit lateral movement from compromised devices, and establishing logs-based monitoring for privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB