EUVD-2026-33810
GHSA-cj7m-v38w-w8vq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or compromise low-privileged app
-
DeliveryStage malformed ARSC resource payload
-
ExploitInvoke system path that loads resource via LoadedArsc::Load
-
ExecutionTrigger heap buffer overflow in libandroidfw
-
PersistHijack control flow in privileged process
-
ImpactExecute code at elevated Android privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already be running unprivileged code on the device (PR:L, AV:L) - typically as an installed app or a process reachable from one - and must be able to cause a privileged Android component that links libandroidfw (e.g., system_server, package manager, installd, or a resource overlay consumer) to load a controlled or malformed ARSC resource table parsed by LoadedArsc::Load() in LoadedArsc.cpp. No user interaction is required (UI:N) and no additional execution privileges are needed post-exploit, but exploitation is limited to Android 14, 15, 16, and 16-qpr2 builds at pre-2026-06-01 patch level, and the attacker still needs a delivery path that gets the crafted resource in front of the vulnerable parser. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) describes a low-complexity local attack from an unprivileged context with full CIA impact, consistent with a typical Android LPE primitive. However, SSVC reports Exploitation: none and Automatable: no, and no EPSS score or KEV listing is provided, so real-world exploitation risk today appears low even though technical impact is rated 'total'. The realistic priority is moderate: it is not an emergency in the absence of observed exploitation, but the bug class (heap overflow in a parser reachable via crafted APK or resource file) is historically chained into n-day Android exploits, so monthly patch ingestion remains important. Note that the reference set is thin - only the Android Security Bulletin is linked - and no POC, vendor-confirmed fix commit, or independent advisory is available to corroborate scope. |
| Exploit ScenarioDerived | A malicious or compromised low-privileged app on the device crafts a malformed ARSC resource table (for example inside an APK it asks the system to parse, or a resource overlay it controls) and triggers libandroidfw's LoadedArsc::Load() path; the resulting heap overflow corrupts memory in a privileged process that handles resources, yielding code execution at that elevated privilege level without any user prompt. No public exploit is identified at time of analysis, but the primitive is consistent with previously chained Android n-day LPEs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Android (versions 14, 15, 16, and 16-qpr2) stems from a heap buffer overflow in the LoadedArsc.cpp resource table loader, allowing a low-privileged local process to write out of bounds and gain elevated execution privileges without user interaction. No public exploit identified at time of analysis, and SSVC scoring indicates exploitation has not been observed despite a 'total' technical impact rating. Patches are tracked in the June 2026 Android Security Bulletin.
RemediationAI
Apply the June 2026 Android security patch level (2026-06-01 or later) as documented in https://source.android.com/docs/security/bulletin/2026/2026-06-01; OEM and carrier rollouts may lag the AOSP publish date, so confirm that the device's Security Patch Level under Settings actually reflects 2026-06-01+. No specific upstream commit hash or tagged libandroidfw release is provided in the input data, so administrators should rely on the bulletin's per-version patch level rather than an exact library version. As a compensating control until devices are patched, restrict installation of untrusted APKs (disable 'Install unknown apps' for all sources, enforce Play Protect, and use MDM to block sideloading) since the attack requires a local low-privileged process and crafted resource content is a likely delivery vector; the trade-off is reduced flexibility for developer and enterprise sideloading workflows.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LoadedArsc.cpp is part of the Android Asset Manager 2 (AAPT2/libandroidfw) runtime, responsible for parsing compiled Android Resource Container (ARSC) files inside APKs. The Load() routine deserializes resource table chunks from disk into heap-backed structures, and CWE-122 (heap-based buffer overflow) here implies a missing or incorrect length check on a chunk header or string-pool offset, causing a write past an allocated buffer. Because libandroidfw is loaded into many privileged system services (e.g., system_server, package manager, install daemons), corrupting its heap from a controllable input path is a well-established route to privilege escalation on Android.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android versions 14 through 16 contain a heap buffer overflow vulnerability enabling local privilege escalation to system-level access without user interaction. Organizations supporting these Android versions face elevated breach risk if users install malicious applications or encounter compromised code, potentially exposing business data and enabling enterprise device compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce application allowlisting and disable sideloading via MDM policies; (2) restrict unnecessary application permissions and local execution capabilities through device management; (3) implement application sandboxing controls where available; (4) enable MDM-based device monitoring to detect unauthorized privilege escalation attempts; (5) establish user awareness training on application install risks and phishing targeting device compromise; (6) where feasible, restrict physical access to unpatched devices and disable local development tools.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Exploit-DB