EUVD-2026-115597
GHSA-4gcx-h8m9-q57q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall unprivileged malicious app
-
DeliveryCall unprotected getMessenger interface
-
ExploitBypass missing permission check
-
ExecutionObtain privileged Wi-Fi P2P access
-
ImpactEscalate privilege locally
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local code execution on the device, specifically an installed application able to call the getMessenger interface of WifiP2pServiceImpl; because the permission check is missing, the app needs no special Wi-Fi or system permission (reflected by PR:N) and no user interaction (UI:N). The practical limiting factors are: the attacker must get an app onto the device (AV:L - not remotely exploitable over a network), and the device must run an affected Android release (14, 15, 16, 16-qpr2, or 17); patched builds from the 2026-11-01 Android Security Bulletin are not vulnerable. No special non-default configuration is described as required. |
| Impact | This is a genuine local privilege-escalation flaw in a ubiquitous platform, but the signals point to moderate real-world urgency rather than an emergency. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a locally-reachable issue requiring no privileges and no user interaction, with full confidentiality, integrity and availability impact on the device - consistent with a missing permission check that lets an unprivileged local app reach a privileged Wi-Fi P2P interface. Against that, the EPSS score is very low (0.12%, 2nd percentile), the CVE is NOT in CISA KEV, and no exploit or PoC reference is supplied, so there is no evidence of active or imminent widespread exploitation. The vuln.today decision label is 'this_week', indicating prioritized-but-not-emergency handling, which aligns with the AV:L constraint: exploitation requires already running code on the target device (e.g. a malicious or compromised app), not remote network access. Note one point worth verifying: the vector sets PR:N (unauthenticated) yet the flaw is a local EoP, so 'PR:N' here means 'any installed app with no special permission' rather than 'remote unauthenticated' - do not read AV:L/PR:N as network-exploitable. |
| Exploit ScenarioDerived | A user installs a seemingly benign app that holds no special permissions. The app invokes the unprotected getMessenger path in WifiP2pServiceImpl, which lacks the required permission check, and thereby obtains privileged Wi-Fi P2P capabilities it should not have, escalating to higher privilege on the device with no user interaction. No public exploit or PoC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 allows any installed application to obtain a handle to the Wi-Fi peer-to-peer service without holding the permission that access normally requires. Because the missing check sits in getMessenger of WifiP2pServiceImpl, the attacker needs no special Wi-Fi or system permission (PR:N), no user interaction (UI:N), and no non-default device configuration - only the ability to run an app on the device (AV:L). The 2026-11-01 Android Security Bulletin supplies the fix, EPSS is 0.12% (2nd percentile), and no public exploit was identified at time of analysis, so this is a moderate-urgency platform issue rather than an emergency.
RemediationAI
Apply the Android security patch level from the 2026-11-01 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-11-01); builds at that patch level are not vulnerable, and no separate workaround is described in the available sources. Prioritise the update on devices running Android 14, 15, 16, 16-qpr2 or 17 that handle sensitive data or are exposed to side-loaded or untrusted applications, since exploitation only requires getting an app installed. Because the flaw is a missing authorization check inside the platform service itself, third-party apps and users cannot remediate it locally, and the vendor bulletin is the only confirmed fix path - validate patch level via Settings or device management before considering a device cleared.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WifiP2pServiceImpl is the Android system service that implements the Wi-Fi Direct (peer-to-peer) framework; getMessenger hands a caller a Messenger/IBinder channel used to exchange messages with that system service. The root cause is CWE-862 (Missing Authorization): the getMessenger path fails to enforce the permission check that should gate access to the service, so an ordinary app - without any Wi-Fi or system-level permission - can bind to and drive functionality that should be reserved for privileged callers. The assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects local attack delivery, no privileges required, no user interaction, and high confidentiality, integrity and availability impact confined to the same security scope. The exact message-level behaviour reachable once the messenger is obtained is not described in the available sources; what is confirmed is the absent permission check on the getMessenger interface and that patched builds from the 2026-11-01 bulletin are not affected.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local app reaches an unprotected interface with no permission (AV:L, PR:N, UI:N); missing authorization is trivially triggered (AC:L) and yields full device C/I/A impact.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android versions 14 through 17 contain a high-severity local privilege escalation flaw (CVE-2026-58867) that lets any installed app bypass permission checks to access the Wi-Fi peer-to-peer service. This affects all Android devices running these versions, potentially allowing malicious apps to abuse Wi-Fi functionality without user awareness. While no public exploit has been identified, the broad install base and lack of a current patch make this a significant platform risk requiring coordinated remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB