EUVD-2026-115402
GHSA-2xm7-xgqf-37pw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall unprivileged malicious app
-
DeliverySend crafted audio-effect broadcast
-
ExploitTrigger confused deputy in MusicFxHelper
-
ExecutionPrivileged component acts on attacker's behalf
-
ImpactGain elevated privileges locally
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Exploitation requires local presence on the device - specifically a locally installed, unprivileged application able to issue the audio-effect broadcast processed by handleAudioEffectBroadcast in MusicFxHelper.java; the confused-deputy condition then causes a more privileged Android component to act on the attacker's behalf. No user interaction and no additional execution privileges are required (UI:N, PR:N). The practical limiting factor is that this is not remotely reachable (AV:L): the attacker must already be able to run code on the device, and only Android versions 14, 15, 16, 16-qpr2, and 17 are listed as affected. The precise trigger conditions of the broadcast handling beyond the confused-deputy description are not detailed in the available sources. |
| Impact | This is a genuine but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a locally-triggered privilege escalation: an attacker needs local presence on the device (a malicious or compromised app) but no pre-existing privileges (PR:N) and no user interaction (UI:N), yielding full confidentiality, integrity and availability impact. CISA's SSVC framing agrees on severity (Technical Impact: total) but tempers urgency: Exploitation is assessed as 'none' (no observed or public exploitation) and Automatable is 'no', consistent with a local EoP that cannot be sprayed remotely. The vuln.today decision label is 'this_week' rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no PoC reference are present in the input, so there is no public exploit identified at time of analysis. Net: a high-impact local privilege-escalation bug worth patching on the normal Android monthly cadence, not a drop-everything remote threat. Note the signals are internally consistent - AV:L matches the description's 'local escalation of privilege' - so there is no attack-vector conflict to flag here. |
| Exploit ScenarioDerived | A malicious application already installed on the device (requiring no special permissions) sends a crafted audio-effect broadcast that MusicFxHelper handles on behalf of a more privileged component. Because of the confused-deputy flaw, that privileged component performs the requested action, letting the app escalate its privileges locally with no user interaction. No public exploit code is identified in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Local privilege escalation in Google Android's MusicFX helper (MusicFxHelper.java, handleAudioEffectBroadcast) lets a locally installed, unprivileged application bypass a permission check through a confused-deputy condition, causing a more privileged Android component to act on the attacker's behalf and yielding high confidentiality, integrity and availability impact. Affected branches listed by the EUVD are Android 14, 15, 16, 16-qpr2 and 17; remote attackers cannot reach the flaw because the attacker must already be running code on the device, and no user interaction or additional execution privileges are required. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none, so this is a genuine but not emergency-level priority scheduled for this week's remediation cycle.
RemediationAI
Install the vendor platform update published in the November 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-11-01), which is the reference for the patched build and patch-level identifiers for each affected branch - Android 14, 15, 16, 16-qpr2 and 17; the available data lists no specific fix version string, so confirm the exact patched build on that bulletin before closing the finding. No workaround, feature toggle or configuration-level mitigation is described in the available sources, and the bulletin is the definitive statement of what the vendor considers the complete fix. Because the CVSS vector is AV:L/PR:N, the practical exposure control is limiting which locally installed applications can run on affected devices, since exploitation requires an attacker-controlled, unprivileged app already present on the handset; this reduces but does not eliminate risk and is not a substitute for the platform update. Note that SSVC records exploitation as none and no public exploit has been identified, so remediation can follow the this_week schedule rather than an emergency break-fix, and there are no side effects to weigh beyond the usual reboot required by an Android system update.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a CWE-441 confused deputy in the platform's audio-effect plumbing. handleAudioEffectBroadcast in MusicFxHelper.java processes a broadcast related to audio effects (MusicFX being the Android audio-effect control surface), and the receiving code does not adequately verify that the caller of the broadcast is entitled to the audio-effect operation it requests. An unprivileged local app therefore induces a component holding broader Android permissions to perform the action on its behalf - the classic deputy pattern - which is scored as scope-unchanged (S:U) privilege escalation with high impact across confidentiality, integrity and availability. The CVSS vector (AV:L/AC:L/PR:N/UI:N) confirms the attack is local-only but otherwise low-complexity with no privileges or user interaction required; the underlying technology is the Android framework's broadcast/audio-effect subsystem rather than a network service. Only the confused-deputy class and the affected file/method are established by the sources; the precise trigger conditions within the broadcast handling beyond that are not described in the available sources.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local app can trigger it without privileges or user interaction (AV:L/AC:L/PR:N/UI:N), and the confused-deputy EoP grants total control, so C/I/A all High.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Articles & Coverage 1
Executive ViewAI
A high-severity privilege escalation vulnerability in Google Android's MusicFX helper (CVE-2026-58965) allows any locally installed app to bypass permission checks and gain elevated access, compromising device confidentiality, integrity, and availability. Affected Android versions 14 through 17 expose enterprise-managed devices and BYOD endpoints to potential data theft or tampering by malicious apps. Leadership should prioritize remediation within the standard weekly cycle; no active exploitation is confirmed, but the broad install base and ease of local exploitation warrant prompt action.
Enforce Google Play Protect and mobile threat defense; restrict installation of apps to trusted sources; apply least privilege to enterprise apps; segment sensitive data from potentially compromised devices; monitor for unusual privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB