Android EUVD-2026-73995

Initial local code execution at a low privilege level is required - for example, via a malicious installed application or local shell access on the Android device (consistent with CVSS PR:L and AV:L). The vulnerable LimitRealloc function resides in the system memory allocator, which is invoked by normal application code, so no special non-default system configuration or privileged feature enablement is needed to reach the vulnerable code path. Exploitation is strictly bounded to the local attack surface: remote exploitation without prior local presence is not applicable. No user interaction is required after the malicious code begins execution. Devices patched to the 2026-09-01 Android Security Patch Level are not affected. The limiting factors are: physical or remote shell access to the device must be established first, and exploitation is not automatable (confirmed by SSVC Automatable: no).

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately characterizes this as a local, low-complexity privilege escalation requiring only minimal prior access - consistent with the description's statement that no additional execution privileges are needed beyond initial local presence. EPSS at 0.12% (2nd percentile) is very low, and SSVC confirms exploitation status as none, indicating no observed weaponization at time of analysis. Despite the total technical impact rating in SSVC, the requirement for prior local code execution (AV:L) meaningfully constrains practical risk: even a mid-sized municipal IT team in gdynia managing a diverse Android device fleet can substantially reduce exposure by enforcing the September 2026 security patch level across managed endpoints. The Denial of Service tag likely reflects a secondary crash risk inherent to UAF conditions, but the primary threat surface is privilege escalation. Absence from CISA KEV and no identified POC suggest this is currently a patch-and-monitor priority rather than an emergency response item.

An attacker installs or executes a malicious application on an unpatched Android 14-17 device under a low-privilege user context. The application deliberately triggers the LimitRealloc logic error in the system memory allocator, creating a use-after-free condition that allows controlled manipulation of freed heap memory. Without requiring any further user interaction, the attacker redirects execution flow to escalate to elevated system privileges, gaining full control over the device's confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis.