EUVD-2026-79159
GHSA-454f-g2fw-hfr4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall/run unprivileged local app
-
DeliveryInvoke Wave6VpuDecFlush decoder path
-
ExploitMissing bounds check allows OOB write
-
ExecutionCorrupt kernel/driver memory
-
ImpactEscalate to system privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local code execution on an affected Android/Pixel device - the attacker must already be able to run an app (even unprivileged) that can reach the Wave6 VPU video-decoder driver's flush routine (Wave6VpuDecFlush in wave6.c); this generally means the device uses the Chips&Media WAVE6-class VPU present on the affected Pixel/Tensor hardware. No user interaction and no prior elevated privileges are needed (PR:N/UI:N). Limiting factors: exploitation is NOT remote (AV:L) - an attacker cannot trigger this over the network and must first get code onto the device, and reliability depends on device-specific memory layout and successful heap/kernel grooming to convert the out-of-bounds write into privilege escalation. |
| Impact | This is a genuine but locally-scoped privilege-escalation flaw, not an internet-facing emergency. The vendor CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.4) is internally consistent: an out-of-bounds write in the Wave6 VPU decoder path (Wave6VpuDecFlush in wave6.c) reachable by an unprivileged local app can corrupt kernel/system memory, and a successful memory-corruption LPE plausibly yields full C:H/I:H/A:H, though C/I/A:H is somewhat generous boilerplate for what is fundamentally an EoP primitive. All exploitation signals point AWAY from urgency: EPSS is 0.11% (2nd percentile - near-baseline), there is NO CISA KEV listing (no confirmed active exploitation), and no public POC was identified. No SSVC decision data was provided. The AV:L (local) designation is well-supported by the description ('local escalation of privilege', 'no additional execution privileges needed', 'user interaction is not needed'), so there is no network/local conflict to reconcile. Bottom line: real, patchable, but a routine mobile-platform LPE to be handled via the normal Android/Pixel monthly update cycle rather than emergency response. |
| Exploit ScenarioDerived | A malicious or compromised low-privilege app installed on an affected Android/Pixel device invokes the Wave6 VPU decoder flush path (Wave6VpuDecFlush) with crafted parameters that bypass the missing bounds check, triggering an out-of-bounds write. By grooming the targeted memory, the attacker corrupts kernel/driver state to elevate to system/kernel privileges without any user interaction. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An out-of-bounds write in the Wave6 VPU video-decoder driver (Wave6VpuDecFlush in wave6.c) lets an unprivileged local app corrupt kernel memory on affected Android devices, escalating to kernel-level privilege and full device compromise. The flaw requires local code execution - an attacker must already be able to run code on the device and reach the decoder's flush routine - but needs no user interaction and no prior elevated privileges (AV:L, PR:N, UI:N). It is not known to be actively exploited, has no identified public exploit code at time of analysis, and carries a low EPSS score of 0.11% (2nd percentile), making it a serious but locally-scoped privilege-escalation issue rather than an internet-facing emergency.
RemediationAI
Primary remediation is to apply the vendor security update for this issue: install the Android/Pixel security patch level that incorporates the September 2026 Pixel bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01), which is where Google publishes the fix for the wave6.c flush path; an exact patched build identifier is not provided in the available data, so confirm the correct build for each device model against that advisory rather than assuming a generic version. Until devices are patched, compensating controls must address the required local foothold: enforce that users install apps only from Google Play and keep Play Protect enabled (reduces, but does not eliminate, the risk from sideloaded or enterprise-deployed APKs), restrict sideloading/unknown-source installs and apply strong MDM application allowlists in managed fleets (side effect: blocks legitimate internal or test builds), and isolate sensitive workloads from unvetted apps on the same device. Restricting physical/USB debugging access and disabling developer options (ADB) removes an additional local code-execution path, though it does not stop a malicious installed app. There are no remote mitigations - network firewalling or segmentation provide no protection because the flaw cannot be triggered remotely, and because the vulnerable code is a kernel driver handling playback of untrusted media, the only durable fix is the vendor patch. Note that patch availability is confirmed only at the level of the vendor bulletin; no exact fix version is stated in the supplied data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the kernel-mode driver for a WAVE6-class video processing unit (VPU), the Chips&Media WAVE-series hardware decoder integrated into Google Tensor/Pixel platforms, which is exercised whenever the device decodes video. The flush routine Wave6VpuDecFlush in wave6.c fails to validate a size or index value before writing into a destination buffer, the classic CWE-120 buffer-copy/out-of-bounds write pattern in which a missing bounds check allows data to be written past the end of an allocated kernel buffer. Because the write occurs in kernel context, a successful, well-groomed exploit can overwrite adjacent kernel structures and pivot to arbitrary code execution at kernel privilege (root-equivalent), yielding high confidentiality, integrity, and availability impact (C:H/I:H/A:H) on the same security scope (S:U). Exploitation is constrained to local attack vectors: the attacker must already have the ability to execute code on the device - typically by installing or tricking the user into installing a malicious app - and reliability depends heavily on device-specific memory layout and successful heap grooming to turn the OOB write into a controlled primitive.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local unprivileged app reaches the VPU driver with no user interaction (AV:L/PR:N/UI:N); an OOB write yielding kernel/system EoP justifies C:H/I:H/A:H, matching the vendor.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A memory-corruption flaw in the Wave6 VPU video-decoder driver shipped on affected Android devices allows any local application to overwrite kernel memory and seize full control of the device, with no elevated privileges or user interaction required. Because the component sits in the kernel and no vendor patch currently exists, every unpatched device in the fleet - corporate-owned and BYOD alike - remains exposed to an attacker who can already run code locally, such as through a malicious or trojanized app. Impact is contained to the individual device rather than network-wide, but the consequence of successful exploitation is complete loss of device integrity, including access to corporate data, credentials, and any enrolled management profile.
No vendor patch is available. Interim mitigations: restrict installation to approved applications only and block sideloading, disable developer options and USB debugging on managed devices, deploy mobile threat defense to detect and block malicious local apps, enforce device encryption and strong lock-screen authentication to reduce data exposure if a device is compromised, monitor for anomalous root or kernel-level activity, and accelerate device replacement or model rotation for the highest-value users until a fixed driver build is issued.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB