EUVD-2026-74022
GHSA-r7p6-r9pv-h9xv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on target device
-
DeliveryExecute low-privilege code
-
ExploitTrigger integer overflow in Android framework
-
ExecutionHeap buffer overflow overwrites kernel/system object
-
PersistEscalate to root or system privilege
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on an Android 16, 16-QPR2, or 17 device - meaning the attacker must have an installed application or interactive shell session with at least low-privilege user-level access. No special Android permissions, no specific hardware configuration, and no user interaction beyond initial app installation are required. The vulnerability is not remotely exploitable in isolation; a separate delivery mechanism (e.g., malicious app installation, physical device access) is a prerequisite. The CVSS AC:L metric indicates no race condition, specific configuration, or timing requirement is needed once local code execution is established. Exploitation is bounded to Android versions 16 through 17 as stated in the bulletin. |
| Impact | The CVSS 7.8 (High) rating is well-calibrated for this class of vulnerability: local privilege escalation with full CIA impact (C:H/I:H/A:H) but bounded by requiring prior code execution on the device (AV:L/PR:L). This is not a remote or zero-click flaw. EPSS at 0.12% (2nd percentile) is low, reflecting that Android local privilege escalation bugs - while serious in principle - historically see sporadic rather than widespread exploitation, especially against patched devices. No CISA KEV listing and no public POC code are present, further reducing near-term exploitation probability. However, the 'multiple locations' wording elevates concern: systemic issues are harder to fully remediate and may leave partial attack surface open even after patching. Android's broad deployment footprint means that even organizations running modest mobile device fleets should prioritize patch application via the September 2026 Android Security Bulletin. The S:U (scope unchanged) metric is consistent - the privilege escalation elevates within the local device OS but does not cross a security scope boundary such as a hypervisor. Overall, this is a genuine high-severity local-escalation issue that warrants prompt patching but is not expected to be a high-volume exploitation target in the short term, barring POC release. |
| Exploit ScenarioDerived | A malicious Android application - requiring only normal user-space execution, with no special permissions - triggers an integer overflow in one of the identified Android framework locations, causing a heap buffer overflow that overwrites adjacent heap metadata or function pointers. The attacker then leverages the corrupted heap state to redirect execution into a privilege escalation payload, gaining root or system-level access on the device. No public proof-of-concept exploit has been identified at time of analysis, but the AV:L/AC:L/PR:L/UI:N profile means exploitation requires only a sideloaded or installed app. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Local privilege escalation affects Android versions 16, 16-qpr2, and 17 via heap-based buffer overflow triggered by integer overflow in multiple framework locations. An attacker with basic local code execution (low-privileged app or shell) can exploit the memory safety flaw - requiring no additional privileges or user interaction - to gain full control of the device, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is identified at time of analysis; EPSS of 0.12% (2nd percentile) indicates low probability of near-term observed exploitation.
RemediationAI
Apply the September 2026 Android Security Bulletin patches via the standard Android OTA update mechanism or vendor security patch level update. The fix is delivered through Android's monthly security bulletin process; the exact patched build will vary by device manufacturer. OEM and carrier partners typically push these updates within weeks of the bulletin release. Device administrators managing enterprise Android fleets should use Android Enterprise or MDM tooling (e.g., Android Zero-Touch, Google Workspace device management) to enforce patch-level compliance to at least 2026-09-01. If patching is delayed, restrict physical and remote access to the device (e.g., disable ADB over network, enforce lockscreen policies) to reduce the window for local code execution that is the precondition for this exploit. Note: restricting ADB access does not eliminate all local code execution vectors (e.g., malicious apps), so patching remains the primary recommended control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), rooted in integer overflow conditions present at multiple code locations within the Android platform. Integer overflow is a classic CWE-190 precursor: when arithmetic on size or offset values wraps around, downstream heap allocation or copy operations use an underestimated buffer size, enabling out-of-bounds write into heap memory. The 'multiple locations' phrasing in the description suggests the issue is systemic across a subsystem - likely within native framework services or kernel-adjacent code - rather than a one-off off-by-one error. Affected versions are Android 16, Android 16-QPR2, and Android 17, as reported in Google's Android Security Bulletin for September 2026 (source: source.android.com/docs/security/bulletin/2026/2026-09-01). The reporter is security@android.com, indicating internal Google discovery. CVSS vector AV:L/AC:L/PR:L/UI:N/S:U confirms local access with low-privilege execution is sufficient and no user interaction is needed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires prior local code execution (AV:L/PR:L); multiple overflow sites make triggering straightforward (AC:L); successful privilege escalation yields full device control (C:H/I:H/A:H).
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible memory safety issue due to integer overflow. This could lead to local escalation of privilege with no additional execution privileges required.
Executive ViewAI
Android versions 16, 16-qpr2, and 17 contain a local privilege escalation vulnerability that allows applications or processes with basic system access to gain complete device control without user interaction. This flaw affects confidentiality, integrity, and availability across any organization deploying these Android versions, particularly in enterprise environments or bring-your-own-device (BYOD) programs where untrusted applications may be installed.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) enforce device management policies to restrict untrusted application installation via allowlisting; (2) deploy mobile threat defense tools with behavioral analytics to detect privilege escalation patterns; (3) implement network segmentation to limit lateral movement from compromised devices; (4) enable logging and monitoring of system-level process activity and memory access anomalies; (5) disable or restrict debugging/developer modes on user devices; (6) educate users to avoid granting unnecessary application permissions. Continuously monitor vendor advisory channels for patch availability and test in non-production environments before enterprise rollout.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Exploit-DB