EUVD-2026-78956
GHSA-c9r2-jhcg-3j9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall/run unprivileged app on device
-
ExploitInvoke enable_segment path in remap.c
-
ExecutionTrigger logic-error permission bypass
-
ImpactEscalate to elevated privileges locally
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Requires local code execution as an unprivileged app on an affected Android/Pixel device (AV:L, PR:N, UI:N), which then reaches the enable_segment function in remap.c to trigger the permission-bypass logic error; no authentication, user interaction, or special device configuration is stated as required. Limiting factors: the attacker must already have an app-level foothold on the device (not remotely exploitable), and only Android kernels at pre-September-2026 patch levels are affected - devices at the 2026-09-01 patch level or later are fixed. |
| Impact | CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields vendor base 8.4 (High), and the metrics are internally consistent with the description: a local, low-complexity permission-bypass logic error that a fully unprivileged app can trigger with no user interaction (PR:N/UI:N). The PR:N is genuine and meaningful here - unlike many sibling Android bulletin entries that require pre-existing System privileges (PR:H), this one is reachable by any unprivileged local app, which is what drives the higher score. Exploitation-likelihood signals are all cold: EPSS is 0.13% (3rd percentile), there is no CISA KEV listing, and no public POC is referenced, so this is not evidence of widespread or imminent exploitation. The C:H/I:H/A:H triad is Google's standard boilerplate for kernel/privilege EoPs and is likely generous - a permission bypass yielding privilege escalation plausibly grants broad impact, but the description does not itemize confidentiality vs. integrity vs. availability effects, so treat full-triple 'High' as vendor assertion rather than confirmed fact. No SSVC decision data was provided. Net: a real, patch-worthy local EoP for Android/Pixel fleets, but a monthly-bulletin-tier priority (fix via the September 2026 patch level) rather than an emergency - its true weight is a function of local-app footprint and reachability, not active-exploitation pressure. |
| Exploit ScenarioDerived | A malicious or compromised unprivileged app installed on an Android/Pixel device invokes the affected memory-remapping path (enable_segment in remap.c) and abuses the logic error to bypass a permission check, escalating its privileges locally with no user interaction. No public exploit code is identified at time of analysis, and the vulnerability is not remotely reachable (AV:L), so it functions as a local privilege-escalation primitive typically chained after an initial app foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Sep 16, 2026
Local privilege escalation in the Android kernel's remap.c enable_segment path allows an unprivileged app to bypass segment permissions and gain elevated privileges on affected Pixel and Android devices (CVSS 8.4, High). Exploitation requires only an app-level foothold with no user interaction, and no public exploit code has been identified at time of analysis; EPSS is low at 0.13% (3rd percentile). Devices at a pre-2026-09-01 patch level remain at risk and are fixed by the Android Security Bulletin dated 2026-09-01.
Earlier versions of this analysis (2)
Local privilege escalation in the Android kernel's segment-remapping path (the enable_segment routine in remap.c) lets an ordinary installed application bypass a permission check and reach high-integrity kernel-level access on affected Pixel/Android devices. Exploitation is strictly local - the attacker must already have unprivileged code running on the device (CVSS:3.1/AV:L/AC:L/PR:N/UI:N, so no elevated privileges and no user interaction are required), and there is no remote or network trigger. Risk is genuine but not urgent: EPSS is 0.13% (3rd percentile), no public exploit code and no CISA KEV entry were identified at time of analysis, and builds carrying the 2026-09-01 patch level are fixed.
Local privilege escalation in the Android kernel memory-remapping code (remap.c, enable_segment) lets an attacker who already runs low-privileged code on the device - an installed malicious app or a local shell - bypass permission checks and gain elevated privileges, affecting confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote and presupposes code already resident on the device, though no user interaction and no additional execution privileges are needed once that foothold exists. No public exploit has been identified at time of analysis and there is no CISA KEV listing; EPSS is 0.13% (3rd percentile), so this is a genuine but not urgent local privilege-escalation issue that should be fixed through the normal monthly Android/Pixel update cycle.
RemediationAI
Apply the vendor-released patch by updating to the Android 2026-09-01 security patch level from the Pixel bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01; devices at that patch level or later are fixed. No kernel-level workaround or feature toggle is documented because the flaw is inside core remap segment-control logic, so pre-patch mitigation depends on reducing the required app-level foothold: restrict installation of untrusted or sideloaded applications, enforce Google Play Protect scanning, and use device-management policies that limit which apps can run. Trade-offs include reduced user flexibility and no guarantee against an already-installed malicious app, so patch deployment should be prioritized.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a protection-mechanism failure (CWE-693) in the Android kernel's remap.c source file, specifically in the enable_segment function that manages segment permission state during memory remapping. A logic error in that function allows a caller with only unprivileged app-level code execution to reach the segment-enable path and have intended access-control or permission checks skipped, yielding kernel-level confidentiality, integrity, and availability impact (C:H/I:H/A:H). The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* identifies the affected platform as Google Android, and the vendor's September 2026 Pixel bulletin indicates the issue affects the Android kernel shipped on Pixel devices. The CVSS vector AV:L/AC:L/PR:N/UI:N is internally consistent with a locally exploitable, low-complexity permission bypass that requires no privileges and no user interaction, matching the independent assessment that an attacker must already have an app-level foothold but needs no authentication or special device configuration.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local unprivileged app (AV:L/PR:N/UI:N) exploiting a kernel logic error to escalate privilege; I retain C/I/A:H per vendor though it is generous for an unspecified permission bypass.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
6DescriptionCVE.org
In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A high-severity local privilege escalation flaw in the Android kernel (CVE-2026-56881, CVSS 8.4) affects Google Pixel devices and the broader Android ecosystem, allowing an app already running on a device to break out of its sandbox and operate with elevated kernel-level privileges. Because the kernel underpins all device security boundaries, a successful exploit could expose corporate email, credentials, MFA tokens, and managed business data on any impacted smartphone or tablet in the fleet. No public exploit code has been identified at time of analysis, so this is a patch-cycle and asset-inventory problem rather than an active incident - but the population of unmanaged and personally-owned Android devices in use by staff is the main source of organizational exposure.
Apply vendor patch (Android Security Bulletin dated 2026-09-01, 2026-09-01 patch level); note the advisory feed lists patch status as not available at time of analysis, so where the update cannot yet be deployed, restrict sideloading and non-approved app sources, enforce mobile threat defense / app vetting on BYOD devices, and reduce the corporate data reachable from non-compliant devices through conditional access until they reach the required patch level.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB