EUVD-2026-33813
GHSA-vvwc-gw3f-hjhm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on Android 16 device
-
DeliveryInvoke vulnerable persistence functions from sandbox
-
ExploitSubmit input bypassing incorrect bounds check
-
ExecutionTrigger buffer overflow and persistence desync
-
PersistEscalate to elevated privileges
-
ImpactEstablish persistent device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already have local code execution on the device at low privilege level (PR:L) - typically meaning a malicious or compromised app installed and running on Android 16 or Android 16-qpr2, which must be able to reach the vulnerable persistence-handling functions. No user interaction is required once that foothold exists (UI:N), and no additional execution privileges are needed per the vendor description. Limiting factors: the AV:L attack vector rules out remote network exploitation, the device must be running Android 16 or 16-qpr2 specifically, and exploitation is gated on first achieving on-device code execution, which itself typically requires sideloading, supply-chain compromise of a legitimate app, or chaining with a separate remote bug. |
| Impact | Signals are mixed but lean toward moderate priority. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local attack vector with low complexity and low privileges, no user interaction, and full CIA impact - consistent with a strong LPE primitive once initial code execution is achieved. CISA's SSVC framing assesses Exploitation as 'none' and Automatable as 'no', though Technical Impact is 'total', meaning if exploited the attacker fully compromises the component. No KEV listing and no POC are referenced, and EPSS data was not provided in the input. The local-only attack vector means this is most relevant as a second-stage primitive chained from an initial app-level RCE or a malicious app already installed, rather than a remote mass-exploitation risk. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app from a sideloaded APK or a compromised third-party store; the app runs as an unprivileged process and invokes the affected persistence-handling code paths with crafted inputs that bypass the faulty bounds check, corrupting memory and desyncing persistence state. The attacker leverages that desync to escalate from app-sandbox privileges to a higher-privileged context on the device, enabling persistent compromise of user data. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local privilege escalation in Google Android 16 and 16-qpr2 allows an attacker with low-privilege code execution on the device to gain elevated privileges by exploiting an incorrect bounds check that causes a desync in persistence logic across multiple functions. Categorized as CWE-120 buffer overflow with high confidentiality, integrity, and availability impact, the flaw requires no user interaction and has no public exploit identified at time of analysis. CISA SSVC scoring indicates no observed exploitation but rates technical impact as total.
RemediationAI
Patch available per vendor advisory: apply the Android Security Patch Level 2026-06-01 or later as published in the June 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-06-01); exact fix version/build number was not provided in the input data, so verify against the SPL string reported under Settings > About phone after update. On devices where the OEM has not yet shipped the June 2026 SPL, compensating controls include restricting sideloading by disabling 'Install unknown apps' for all sources, enforcing Google Play Protect, and using MDM policies to block installation of non-vetted applications - these reduce the likelihood that an attacker can obtain the local foothold needed to chain this LPE, at the cost of constraining user app choice and developer-mode workflows.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-120 classic buffer copy without checking size of input (buffer overflow) located in the Android platform's persistence-handling code paths. According to the description, multiple functions perform an incorrect bounds check that produces a desync condition in persistence state, which a local attacker can leverage to corrupt memory or state used in privilege decisions. The CPE string cpe:2.3:a:google:android scopes the issue to the Android operating system itself rather than a specific OEM layer, and the tag 'Buffer Overflow' aligns directly with the CWE root cause class.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (google_android) · only source for this CVE.
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android 16 and 16-qpr2 devices contain a privilege escalation vulnerability (CVE-2026-28580) that allows attackers with initial device access to gain full administrative control, creating direct risk to organizational data confidentiality and system integrity. This impacts all enterprises deploying these Android versions and exposes sensitive business information to unauthorized access. No vendor patch is available, requiring immediate compensating security controls.
No vendor-released patch identified at time of analysis. Implement: MDM-enforced app permission restrictions and runtime behavior monitoring; disable sideloading and USB debugging; restrict app installation to approved sources only; enable privilege escalation detection and alerting; implement network segmentation to contain impact of device compromise; enhance endpoint telemetry logging for security investigation and incident response.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB