EUVD-2026-78982
GHSA-6wf3-mcf2-rv28
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain System-level code execution
-
ExploitInvoke affected permission-gated code path
-
ExecutionLogic error bypasses permission check
-
ImpactEscalate privilege beyond intended System scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires the attacker to ALREADY hold System execution privileges on the affected Android/Pixel device (per the description and PR:H) and to reach one of the unspecified 'multiple locations' where a logic error skips a permission check. Local access only (AV:L) - no remote or network vector. No user interaction is required (UI:N). The high privilege prerequisite is the dominant limiting factor: this cannot be used for initial compromise or to escalate from an ordinary unprivileged app; it only extends the reach of an actor that has already achieved System. |
| Impact | This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 6.7 Medium) describes a local privilege-escalation flaw that already requires PR:H - the description explicitly states 'System execution privileges needed.' That is a critical caveat: an attacker must already be running with System-level privileges to trigger the bypass, which sharply limits real-world value since System is already one of the most privileged contexts on Android. The C:H/I:H/A:H impact metrics are therefore generous - an attacker at System gains marginal additional privilege, not a leap from unprivileged code. Corroborating signals all point to low urgency: EPSS is 0.13% (3rd percentile), there is no CISA KEV listing, and no public POC. No signals conflict - the low EPSS, absence of KEV, and high privilege prerequisite are mutually consistent. This is a routine Android/Pixel monthly-bulletin hardening fix, not an actively exploited threat. |
| Exploit ScenarioDerived | A malicious or compromised process already executing with System privileges on an Android/Pixel device invokes an affected code path where a logic error skips a permission check, allowing it to perform an action it should be denied. No user interaction is required. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
RemediationAI
Apply the vendor fix by updating affected Android/Pixel devices to a build that includes the September 2026 Android Security Bulletin for Pixel, 2026-09-01, per https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01; because the bulletin is the authoritative source for device-specific builds, verify the device's Android security patch level after updating rather than relying on a generic platform version. Patch status for this issue is best described as: patch available per vendor advisory, with no independently confirmed standalone fix version number supplied in the input data, so do not assume a specific build string beyond what the advisory states. Separately, note that exploitation requires an attacker to already possess System execution privileges, so the highest-value compensating controls are those that prevent an actor from reaching that state in the first place: keep the platform fully patched against privilege-escalation chains that could grant System, enforce verified boot and hardware-backed key attestation so tampered system partitions are detectable, and restrict sideloading and developer options via managed-device policy to reduce the attack paths an actor could use to obtain privileged code execution. If a device cannot be updated promptly, reducing the number of installed apps holding privileged or system-adjacent permissions and monitoring for anomalous System-uid activity (unexpected privileged service calls, unusual file access under /system or kernel interfaces) provides detection value, but these are detective and reducing controls with real trade-offs - they constrain legitimate system service behavior and can increase false positives or break vendor features - and they do not remove the underlying permission-bypass logic error.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-56979 is classified as CWE-693 (Protection Mechanism Failure), and the description attributes it to a logic error in the code that omits or misroutes a permission check in multiple locations. In Android's security model, System (uid 1000) is a highly privileged account used by core system services; a bypass at that layer means a component already running as System can reach resources or operations that should remain gated behind an even higher privilege boundary, effectively an intra-system privilege extension rather than an app-to-system escalation. Public CPE data maps the affected platform to cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, and EUVD lists the affected component set as "Android Android kernel", indicating the permission logic resides in Android platform/kernel code rather than in an application. The CVSS:3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the access profile: purely local attack surface, low complexity once the prerequisite is met, high privileges required, no user interaction, and high confidentiality, integrity and availability impact within the same security scope. Because the privilege prerequisite is the dominant limiting factor, the practical risk is confined to threat actors who have already achieved System execution - for example via chained exploitation or a compromised privileged service - and who could then use the bypass to deepen their foothold.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local vector and System-privilege prerequisite fix AV:L/PR:H/UI:N; I retain the vendor's C/I/A:H though they are generous given the attacker already runs as System.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB