EUVD-2026-115425
GHSA-p97c-fg65-254m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious local app
-
ExploitCall getSubscriptionProperty without required permission
-
ExecutionMissing permission check returns data
-
ImpactDisclose subscription property information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the device - specifically a locally running app (or an actor with local/ADB access) that calls getSubscriptionProperty in SubscriptionManagerService. Because the permission check is missing (CWE-862), the calling app does NOT need the permission that would normally be required and needs no other execution privileges, and no user interaction is required (consistent with PR:N/UI:N). Exploitation is limited by the local attack vector (AV:L) - there is no remote path - by the low-severity confidentiality-only impact (subscription property data, C:L, no integrity/availability effect), and by the affected-version scope (Android 14, 15, 16, 16-qpr2, 17); devices patched via the 2026-11-01 Android bulletin are not affected. |
| Impact | This is a moderate, low-urgency issue rather than a top priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.0) shows the flaw is exploitable only locally (AV:L) - not remotely - with low complexity and no privileges or user interaction, but the impact is confined to low-severity confidentiality loss (C:L) with no integrity or availability effect, consistent with CWE-862 missing authorization leading to information disclosure. Exploitation signals are weak: EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data, so this is not confirmed to be exploited. The vuln.today decision label is 'this_month', indicating routine patch-cycle urgency rather than emergency. The signals are internally consistent - low real-world exploitation probability, local-only vector, and limited impact all point to a genuinely low-to-moderate risk despite the finding being valid. No signals conflict. Note that the 'Authentication Bypass' tag overstates the issue: per the description and CWE-862 this is a missing permission (authorization) check, not an authentication bypass. |
| Exploit ScenarioDerived | A malicious or untrusted app already installed on an Android device invokes getSubscriptionProperty in SubscriptionManagerService without holding the permission that should gate the call, and because the permission check is missing it receives subscription property information it should not be able to read. No user interaction and no elevated privileges are required. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
A local information disclosure in Android's SubscriptionManagerService (CVE-2026-59003) allows a locally installed app - or an actor with local or ADB access - to read subscription property data via getSubscriptionProperty without holding the permission the API normally requires, because the permission check is missing (CWE-862). No user interaction and no additional execution privileges are needed, but the attack vector is strictly local (AV:L) and impact is limited to confidentiality (C:L, CVSS 4.0), with no integrity or availability effect. Affected builds span Android 14, 15, 16, 16-qpr2 and 17; EPSS is 0.11% (1st percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and the issue is rated moderate with low urgency, scheduled for this month.
RemediationAI
Apply the Android Security Bulletin update dated 2026-11-01 (https://source.android.com/docs/security/bulletin/2026/2026-11-01), which covers the SubscriptionManagerService permission-check fix for Android 14, 15, 16, 16-qpr2 and 17 - patch availability is confirmed via the vendor bulletin, and the concrete fixed build identifiers per branch are listed there rather than in this dataset. Because the flaw requires local code execution or ADB-level local access and leaks only subscription property data, the practical exposure window is bounded; device owners and fleet administrators should prioritise the update on devices that permit sideloaded or untrusted local apps and on developer/ADB-enabled units. Where the bulletin update cannot yet be deployed, the available compensating control is to reduce the local attack surface: disable developer options and USB/ADB access, remove or restrict sideloaded and untrusted applications, and rely on the platform's app sandboxing - with the trade-off that these measures only narrow who can reach the binder endpoint and do not remove the missing permission check itself. EUVD and NVD records (https://nvd.nist.gov/vuln/detail/CVE-2026-59003) can be tracked for any revision to the advisory.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SubscriptionManagerService is the Android system service that brokers telephony subscription data - embedded and removable SIM/UICC and eSIM subscription records - to callers, and getSubscriptionProperty is one of its binder-exposed AIDL entry points. CWE-862 (Missing Authorization) is the root-cause class here: the service method reads and returns a subscription property without enforcing the caller's permission, so a request that should be rejected on permission grounds is served instead. Because the API is reachable over binder from any local app context (and from a local/ADB shell actor), the practical boundary is the device-local attack surface rather than the network - the CVSS vector is AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting low-effort local triggering with unprivileged, interaction-free invocation and a confidentiality-only impact. CPE data attributes the flaw to google:android (cpe:2.3:a:google:android), and EUVD enumerates Android 14, 15, 16, 16-qpr2 and 17 as affected, with the 2026-11-01 Android Security Bulletin covering the fix. The trigger mechanics beyond the missing permission check in getSubscriptionProperty of SubscriptionManagerService.java are not described in the available sources.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Local app can call the API with no permission (AV:L, PR:N, UI:N); missing check is trivially reachable (AC:L); only limited subscription data leaks (C:L, I:N, A:N).
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB