EUVD-2026-74006
GHSA-63mh-7mg2-j9fp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on Android 17 device
-
DeliveryInvoke serviceClassExists via in-call service binding
-
ExploitTrigger logic error bypassing permission check
-
ExecutionExecute arbitrary code in telecom process context
-
PersistEscalate to privileged system service credentials
-
ImpactAchieve full C/I/A control of telecom subsystem
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires a malicious application to be installed and running on the target Android 17 device with at least low-level user privileges (PR:L). The attacker must have local access - either physical, via ADB shell, or through a previously installed app. No user interaction is needed after the malicious app is present. The vulnerability is limited to Android 17 and is specific to the telephony framework's InCallController component, meaning devices not on Android 17 or without active telecom service binding are not directly affected. Exploitation is non-automatable per SSVC, ruling out worm-style propagation. |
| Impact | The CVSS 7.8 score reflects a meaningful local privilege escalation with full C/I/A impact on the vulnerable component. However, multiple signals reduce practical urgency: EPSS is 0.18% (8th percentile), SSVC exploitation status is none, and no KEV listing or public POC exists. The attack is non-automatable per SSVC and requires a malicious app (PR:L) already running on the device - an additional pre-condition filtering out casual exploitation. The CVSS technical impact aligns with SSVC's 'total' rating, meaning successful exploitation yields full compromise of the telecom process. Real-world risk is therefore moderate: dangerous in targeted scenarios (e.g., malware already installed on device, enterprise spyware), but not a widespread mass-exploitation threat. No conflicting signals between CVSS vector and description - both indicate local access with low privileges. |
| Exploit ScenarioDerived | A threat actor distributes a malicious Android application that, once installed on an Android 17 device, triggers the logic error in serviceClassExists by invoking a specific in-call service class binding sequence. The app exploits the protection mechanism failure to execute arbitrary code within the context of the privileged telecom service process, effectively achieving system-level privilege escalation without requiring the user to take any further action after installation. No public POC exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Local privilege escalation in Android 17's telephony stack allows a low-privileged app to achieve arbitrary code execution without user interaction. The logic error in the serviceClassExists method of InCallController.java (CWE-693, Protection Mechanism Failure) enables an attacker with local shell or app access to elevate privileges to those of the telecom service process, gaining full read, write, and execution control. No public exploit exists at time of analysis, and SSVC assesses exploitation as none, though the technical impact is rated total.
RemediationAI
Apply the security patches distributed via the Android Security Bulletin for the 2026-09-01 patch level, available at https://source.android.com/docs/security/bulletin/2026/2026-09-01. Device manufacturers (OEMs) and carriers must integrate and distribute this patch to end users; update timelines vary by vendor. As a compensating control where patching is delayed, restrict sideloading and enforce device management policies (MDM) that prevent installation of untrusted APKs, since exploitation requires a low-privileged app already on the device. Enforcing Google Play Protect and reviewing installed applications for anomalous telecom-related permissions reduces exposure. No workaround exists that neutralizes the logic error in InCallController.java directly.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
InCallController.java is a core component of the Android Telecom framework responsible for managing in-call service binding and routing. The serviceClassExists method contains a logic error (CWE-693: Protection Mechanism Failure) - a class of bugs where a security check is present but incorrectly implemented, effectively nullifying the intended protection. The vulnerability affects Android 17 as identified by EUVD and the Android Security Bulletin for 2026-09-01. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms exploitation requires local access with low privileges and no user interaction, consistent with a malicious app exploiting a flaw in a privileged system service. CWE-693 specifically indicates the protection mechanism (likely a service class ownership or permission check) exists in code but fails to enforce the intended restriction due to a logic path error.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low-privileged app required (AV:L/PR:L); logic error is straightforward to trigger once present (AC:L); full process compromise yields C:H/I:H/A:H.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android 17 devices face a local privilege escalation vulnerability in the telephony stack that allows attackers with app-level or shell access to execute arbitrary code as the telecom service, potentially compromising sensitive call handling and communications. No public exploit code has been identified at time of analysis, and real-world exploitation probability is currently low (EPSS 0.2%), though the critical impact on device control requires prompt inventory, hardening, and patch readiness. Organizations deploying Android 17 for communications-sensitive functions should prioritize access control restrictions and monitoring while awaiting vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict app permissions to deny telecom framework access where not required for business function, implemented through app management policies; (2) enforce managed device policies that limit shell and root-level access; (3) deploy device-level process monitoring to detect anomalous privilege elevation attempts targeting telecom service components; (4) isolate devices handling sensitive communications from unrestricted app installation sources; (5) enable SELinux and security module audit logging on affected devices to track protection mechanism bypass attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB