EUVD-2026-74014
GHSA-qr9q-5q9q-f296
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious low-privilege app
-
DeliveryTrigger integer overflow in Android system component
-
ExploitOut-of-bounds write corrupts privileged memory
-
ExecutionHijack higher-privileged process execution
-
ImpactAchieve local privilege escalation to system/root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local access is required - the attacker must have a process executing on the device with at least low-privilege access, such as a standard installed application (AV:L/PR:L per CVSS). No user interaction is needed once the malicious process is running (UI:N). No additional execution privileges beyond standard app execution are required. The vulnerability affects Android 17 and Android 16-qpr2 specifically; devices running patched builds at or above the 2026-09-01 security patch level are not affected. The limiting factors are physical or logical device access and the ability to install or run an application - remote-only threat actors cannot exploit this directly without a prior foothold. |
| Impact | The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) vector accurately reflects the local-only attack surface: exploitation requires an installed, low-privileged process or application on the target device. While the C/I/A:H triad signals total compromise of the vulnerable system, the local attack vector (AV:L) materially limits exposure compared to network-exploitable flaws. SSVC corroborates this: Exploitation is 'none' and Automatable is 'no,' indicating no known in-the-wild use and that mass automated targeting is not feasible. EPSS data is not provided. The combination of no KEV listing, no POC, and the local-only vector places real-world prioritization below network-exploitable Android vulnerabilities - however, the 'multiple locations' scope raises concern that a sufficiently motivated attacker (e.g., targeting high-value individuals via a malicious app) could chain this with an existing foothold. The 'total' technical impact rating means successful exploitation achieves full device control. |
| Exploit ScenarioDerived | An attacker distributes a malicious Android application that, once installed and granted standard low-privilege execution, triggers the integer overflow in a vulnerable Android system component. The resulting out-of-bounds write corrupts adjacent memory belonging to a higher-privileged process, allowing the attacker's app to escape its sandbox and attain elevated system or root privileges on the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Local privilege escalation in Android 17 and Android 16-qpr2 stems from integer overflow vulnerabilities across multiple code locations, enabling out-of-bounds writes. A low-privileged local process or application can exploit these flaws without additional execution privileges or user interaction to gain full control over the device. No public exploit has been identified at time of analysis, and SSVC signals no current exploitation activity, but technical impact is rated total.
RemediationAI
Apply the Android Security Bulletin for September 2026 (patch level 2026-09-01), referenced at https://source.android.com/docs/security/bulletin/2026/2026-09-01. Device users should install OEM-provided system updates that incorporate this patch level, as individual Android OEMs distribute the bulletin fixes through their own update channels (e.g., Samsung, Google Pixel OTA). The exact patched build version varies by device and manufacturer. As a compensating control where patching is delayed, restricting installation of untrusted or sideloaded applications reduces the attacker's ability to land a low-privileged process on the device, which is a prerequisite for exploitation. Enterprise environments managing Android fleets via MDM should enforce minimum patch level 2026-09-01. No workaround fully eliminates the vulnerability absent the patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-190 (Integer Overflow or Wraparound) describes arithmetic operations where integer values exceed their maximum, wrapping to an unexpectedly small value. In this context, the wrapped value is likely used as a buffer size or array index, causing subsequent writes to extend beyond allocated memory boundaries - the secondary 'Buffer Overflow' tag reflects this consequence. The description notes 'multiple locations,' indicating the pattern appears across more than one Android component or subsystem rather than a single isolated function. Affected versions per EUVD are Android 17 and Android 16-qpr2 (the second quarterly platform release of Android 16). No specific CPE strings or subsystem names (e.g., Binder, media codecs, kernel drivers) are identified in the available data, which limits precise component attribution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector with low privileges matches standard installed-app execution; full CIA impact reflects total device compromise upon successful privilege escalation.
Primary rating from Vendor (android).
CVSS VectorVendor: android
DescriptionCVE.org
In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android 17 and Android 16-qpr2 devices are vulnerable to a local privilege escalation flaw that allows any installed application to gain complete control of the device, potentially exposing all user data, credentials, and enabling persistent malware installation. This vulnerability affects the entire Android user base on these versions and poses a direct risk to organizations' mobile security posture, particularly for employees with access to sensitive corporate data. No security patch is currently available from Google.
Until patch availability: enforce installation from official Google Play Store only, implement strict app permission reviews and removal of unused applications, configure MDM to restrict background execution and limit file system access, isolate affected devices from critical infrastructure networks, enable continuous monitoring for privilege escalation indicators, and require additional authentication factors for access to sensitive data from these devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Exploit-DB