Android CVE-2026-55294

Exploitation requires a low-privileged process or application running locally on the affected Android device (AV:L, PR:L per CVSS) that can invoke the Android MediaCodec HEVC decoder - either by processing a crafted video file or by feeding malformed H.265 bitstream data into the decoder programmatically. No user interaction is required beyond whatever interaction installs or runs the attacker-controlled app (UI:N per CVSS). No special non-default configuration is required: HEVC decoding is enabled by default on all affected Android versions, and any app with media permissions or file access can reach the vulnerable code path. Exploitation is bounded by the requirement for local execution - a remote-only attacker cannot trigger this vulnerability directly without first achieving local code execution through a separate vulnerability (such as a WebView exploit). SSVC Automatable is 'no', confirming that mass unauthenticated network-based exploitation is not feasible for this vulnerability in isolation.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) is internally consistent and accurately reflects a local, low-complexity privilege escalation: an attacker needs only app-level execution on the target device, no special configuration, and no victim interaction. SSVC ratings reinforce a measured response - Exploitation is 'none' (no observed active exploitation), Automatable is 'no' (mass network delivery is not feasible without a separate local-access vector), and Technical Impact is 'total' (successful exploitation yields full device confidentiality, integrity, and availability compromise). The vulnerability is not listed in the CISA KEV catalog and no public exploit code was provided in the intelligence data, which together suggest it has not yet been weaponized for widespread campaigns. No EPSS score was supplied, so probabilistic exploitation rate relative to the broader CVE population cannot be quantified. The most significant real-world risk is its use as the privilege-escalation stage in a multi-step exploit chain - for example, chained after a WebView or renderer compromise to break out of the Android application sandbox. Given that all actively supported Android major versions are affected, the patch surface is broad and OEM update lag could leave devices exposed well beyond the September 2026 bulletin date.

A threat actor packages a crafted HEVC video file within a malicious Android application distributed through a third-party app store or phishing campaign. When the application processes the video through the Android MediaCodec framework, ihevcd_get_tu_data_size miscalculates the transform unit buffer size, triggering a heap out-of-bounds write that corrupts adjacent heap metadata or function pointers. The attacker uses this primitive to redirect execution flow and escape the application sandbox, acquiring elevated system privileges on the device. No public proof-of-concept code has been identified, but heap overflow exploitation for Android privilege escalation is a well-documented technique in the security research community.