Google Android EUVD-2026-78949

Exploitation requires two concrete things documented in the source data: local access on the target Android device, and pre-existing code execution with Android System privileges (the description states 'System execution privileges needed', and the CVSS vector confirms PR:H). No user interaction is required (UI:N), and complexity is low (AC:L). What limits real-world exploitation is precisely this privilege gate - an attacker must already have won a first-stage compromise that yields System uid, which excludes unauthenticated remote attackers and typical third-party apps. The CPE is version-wildcarded and the EUVD data names the Android kernel generically, so the specific vulnerable kernel module and the device/build configurations in which it is reachable are not enumerated in the supplied data and must be confirmed against the September 2026 Pixel bulletin.

The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.7) tells a very specific story: the attack is local, low complexity and needs no user interaction, but it requires high privileges (PR:H) - consistent with the description stating System execution privileges are needed. That PR:H gate materially lowers real-world risk compared with a typical remote Android EoP, even though the resulting impact on confidentiality, integrity and availability is high and unscoped. There is no EPSS score, no KEV listing and no POC reference in the supplied data, so exploitation appears neither confirmed nor commoditised; a chained exploit would first have to obtain System-level code execution, which is itself a significant prerequisite - even a mid-sized municipal IT team in sanok should treat this as urgent only for already-compromised or high-value devices where System access is plausible, rather than as a network-facing emergency. Confidence in the risk picture is moderate: the severity metrics are internally consistent, but the absence of EPSS/KEV/POC data means the exploitation likelihood is inferred from the CVSS privilege gate rather than confirmed by telemetry.

An attacker who has already achieved code execution as the Android System user - for example through a chained application-level or vendor-component flaw - passes crafted input to one of the vulnerable kernel code paths, triggering an out-of-bounds write. The corrupted kernel memory is shaped into a controlled structure, allowing the attacker to escalate from System to kernel/root and take full control of the device. Exploitation is low-complexity and needs no user interaction, but the prerequisite of pre-existing System privileges keeps this a second-stage escalate rather than an entry point.