OnePlus OxygenOS CVE-2026-70387

Exploitation requires local code execution on an affected OxygenOS device and a calling process with uid 0 in a SELinux domain that policy grants binder access to the olc2 logging HAL; the HAL's only authorization is getCallingUid()==0, with no command validation. The practical limiting factor is reaching such a uid-0 domain: the description identifies dumpstate as a qualifying domain reachable from an unprivileged app via a separate chained flaw (Vulnerability 1), so full exploitation depends on that chain. Further limits: the issue is local-only (binder IPC, no network vector), requires no user interaction, and applies only to OxygenOS builds below 16.1.10.500 / 16.0.5.1200 / 15.0.0.2000. Patched versions and non-chainable deployments are not exploitable by an unprivileged attacker.

CVSS 4.0 base score is 8.4 (High) with vector AV:L/AC:L/PR:H/UI:N and full confidentiality, integrity and availability impact (VC:H/VI:H/VA:H), classifying this as a high-impact local privilege-escalation issue rather than a remotely exploitable one. The attack vector is local (binder IPC), and the stated authorization barrier is PR:H because the direct caller must already be uid 0. However, the description materially weakens that barrier: SELinux policy exposes the olc2 HAL binder interface to a broad client attribute, and at least one qualifying uid-0 domain (dumpstate) is reachable from an unprivileged app through a separate chained flaw (Vulnerability 1), so the realistic entry point is lower than PR:H alone implies. No EPSS score and no KEV status are present in the input, and no POC=YES flag is set, so there is no structured signal of active or probabilistic exploitation to corroborate the CVSS severity. That said, the single reference is a detailed public technical writeup ('oneplus-root', nns.ee, 2026-09-24) that documents the full rooting chain, which in practice lowers the exploitation barrier and should be weighed above the absence of a POC flag. Net: a genuine, high-value local root chain for affected OnePlus devices, but not a mass/remote exploitation priority - reach requires local presence on the device and the chaining vulnerability. Missing EPSS/KEV data should be verified before deprioritizing.

An attacker who can run code on an affected OnePlus device - via a malicious installed app chained through Vulnerability 1 to reach the uid-0 dumpstate context - invokes the olc2 logging HAL binder method with an attacker-supplied command string. The HAL's sole check is getCallingUid()==0, so it fork()s and execl()s /vendor/bin/sh, and the spawned shell lands in the u:r:vendor_qti_init_shell:s0 domain holding all Linux capabilities, yielding arbitrary command execution and effective device root. A detailed public technical writeup of this chain exists, so the technique is documented even though no structured POC flag is set in the input.