Google Android EUVD-2026-115625

Exploitation requires pre-existing local System-level execution privileges on an affected Android 17 device (per CVSS PR:H and the bulletin's 'System execution privileges needed' statement) and a code path that reaches is_valid_header in timed_cache_item.c with attacker-influenced input that overflows the missing bounds check. No user interaction is required (UI:N), and the attack is local only (AV:L) - it is not remotely reachable over a network. The primary limiting factor is the high privilege prerequisite: an attacker must already run as System, which means this is a post-compromise escalation/consolidation primitive rather than an initial-access vulnerability. The affected scope is attributed to the Wear OS bulletin (Android 17), which narrows the realistic target population relative to the full Android phone fleet. The exact triggering input and which component invokes is_valid_header are not described in the available sources.

This is a locally-exploitable, high-privilege elevation-of-privilege flaw whose signals consistently point to moderate, non-urgent risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U, 6.7 Medium) requires that the attacker already hold System-level (PR:H) execution privileges locally - the Android bulletin phrasing 'System execution privileges needed' confirms this is a privilege prerequisite, not a remote entry point, so it is useful to an attacker chaining up from an already-compromised System context rather than as an initial foothold. The exploitation-likelihood signals reinforce low urgency: EPSS is 0.15% (4th percentile), the CVE is NOT on the CISA KEV list, and no public PoC or exploit reference is supplied. The vuln.today decision label is 'this_month' (routine patch cadence), which is consistent with a locally-scoped, high-privilege bug that lacks evidence of active exploitation. No SSVC decision fields (automatable, technical impact, exploitation) were provided, so that framework cannot be independently applied here. One point to verify with the vendor: the description says exploitation needs System privileges yet still classifies the outcome as 'escalation of privilege,' which is typical Android bulletin language for a bug that elevates within or beyond an already-privileged System context - the exact starting and ending privilege boundary is not fully spelled out in the available sources.

An attacker who has already achieved local code execution at the System privilege level on an affected Android 17 (Wear OS) device triggers the missing bounds check in is_valid_header of timed_cache_item.c, producing a controlled out-of-bounds write that corrupts adjacent memory to further elevate or solidify privileged execution. No user interaction is required. No public exploit code or PoC reference was provided in the available data.