EUVD-2026-78951
GHSA-ph5h-q254-wcfj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Google_Devices) · only source for this CVE.
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
An integer overflow in the Android VPU (video processing unit) driver's size handling leads to an out-of-bounds write in kernel memory, allowing a locally installed application to escalate privileges to kernel/system level on affected Pixel devices. Exploitation requires only local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, making it attractive for a malicious or trojanized app. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today