EUVD-2026-52864
GHSA-6744-29jh-3wrc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall or run malicious app on device
-
DeliveryOpen VPU device node
-
ExploitIssue crafted ioctl to vpu_ioctl.c
-
ExecutionTrigger use-after-free and reclaim freed object
-
PersistCorrupt kernel structures
-
ImpactExecute code with kernel privileges
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to invoke ioctl operations against the VPU kernel driver (vpu_ioctl.c), which in practice means a local, unprivileged application running on an affected Android/Pixel device with access to the VPU device node - the CVE states no additional execution privileges and no user interaction are needed. The published CVSS AV:N/PR:N implies remote unauthenticated exploitation, but the driver-ioctl nature strongly indicates a local application context is the real prerequisite; this discrepancy should be verified against the Android bulletin. Limiting factors are the need to get code (an app) running on the device and the device being on a vulnerable Android security patch level from before the 2026-08-01 fix; devices already at that patch level are not exploitable. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) implies unauthenticated network exploitation, but this conflicts with the technical nature of the flaw: vpu_ioctl.c is a kernel driver reached via local ioctl calls, which normally requires a local app (AV:L, PR:L). Android bulletins frequently label local EoP flaws as 'remote' and inflate the vector, so the network vector should be verified against the actual attack surface. SSVC gives a more grounded read: Exploitation is 'none' (no observed or public exploit), but Automatable is 'yes' and Technical Impact is 'total', meaning that once a working trigger exists it can be reliably scripted for full kernel compromise. It is not in CISA KEV and no POC is referenced, so this is a high-severity-but-not-yet-exploited issue; priority is driven by the total technical impact and automatability rather than by evidence of active exploitation. No EPSS score was provided in the input. |
| Exploit ScenarioDerived | A malicious or compromised app installed on an Android/Pixel device issues crafted ioctl calls to the VPU device node, triggering the use-after-free in vpu_ioctl.c and reclaiming the freed kernel object with controlled data to overwrite kernel structures. Given AV/AC-low and no required user interaction, this grants the app kernel-level privileges and full device takeover. No public POC is referenced at time of analysis, but SSVC marks the flaw as automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 04, 2026
Privilege escalation in the Android kernel VPU (Video Processing Unit) driver stems from a use-after-free in vpu_ioctl.c, allowing an attacker to elevate to kernel-level privileges without any additional execution privileges or user interaction. It affects Google Android devices (per the Pixel security bulletin for 2026-08-01), and Android's advisory states no user interaction is required; SSVC rates the technical impact as total and the flaw as automatable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the total-impact, no-interaction profile makes it a high-priority patch target.
RemediationAI
Patch available per vendor advisory: apply the Android security patch level corresponding to the Google Pixel bulletin dated 2026-08-01 (https://source.android.com/docs/security/bulletin/pixel/2026/2026-08-01) as soon as it is offered by the device OEM, since this is the primary and recommended fix. No exact fixed version string is provided in the input, so confirm the required security patch level directly from that bulletin before deployment. As a compensating control until patched, restrict installation of untrusted third-party applications (the realistic vector for reaching the VPU ioctl interface) and use OEM/MDM controls to block sideloading and unknown sources; on managed fleets, enforce update deferral policies. There is no documented toggle to disable the VPU driver without breaking media and camera functionality, so device-level app-trust hardening is the practical interim mitigation and its trade-off is reduced ability to install legitimate third-party apps.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) in multiple functions of vpu_ioctl.c, the ioctl handler for the Video Processing Unit kernel driver used on Android/Pixel SoCs. A use-after-free occurs when kernel code continues to reference an object after it has been freed, letting an attacker reclaim that freed memory with attacker-controlled data and manipulate kernel structures (such as function pointers) to hijack execution flow. Because VPU drivers are exposed to userspace through ioctl system calls, a local application interacting with the VPU device node can trigger the dangling reference. The CPE cpe:2.3:a:google:android identifies Google Android as the affected platform, specifically the Android kernel component shipped in Pixel firmware.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Kernel VPU driver is reached via local ioctl from an installed app, so AV:L and PR:L; the UAF yields full kernel compromise giving C:H/I:H/A:H.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
2DescriptionCVE.org
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
CVE-2026-0163 is a critical privilege escalation in Android kernel VPU drivers affecting Google Pixel and Android devices, allowing unauthenticated attackers to gain complete kernel-level control without any user interaction. No patch is currently available, leaving all affected devices in corporate and personal use vulnerable to complete compromise, data exfiltration, and malware installation. Organizations managing Android fleets face immediate risk to sensitive data and operational integrity until Google releases a security update.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network segmentation isolating vulnerable Android devices from critical systems and sensitive data repositories; (2) Disable VPU driver functionality through device configuration where operationally feasible to reduce attack surface; (3) Restrict kernel-level process execution permissions on affected devices via SELinux policies; (4) Enable enhanced audit logging and monitoring of kernel activity on vulnerable devices; (5) Enforce mandatory device isolation protocols for any Android device until patched; (6) Restrict application installation permissions and limit sideloading capabilities to reduce secondary exploitation vectors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB