EUVD-2026-78959
GHSA-xv6f-qgr5-frxf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain System execution context on device
-
DeliverySupply crafted values to affected code paths
-
ExploitTrigger integer overflow in permission check
-
ExecutionBypass permission boundary
-
ImpactEscalate privilege beyond System-granted scope
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess Android System execution privileges (PR:H) and local access (AV:L) to the device; the description explicitly states 'System execution privileges needed.' No user interaction is required (UI:N). The limiting factor is significant: this is not reachable by an ordinary unprivileged app or remote attacker - the actor must first obtain a System-level execution context, so it functions as a privilege-boundary escape usable only as a secondary step after an initial System-level compromise. Affected surface is Android as shipped on Pixel devices per the September 2026 Pixel bulletin. |
| Impact | This is a genuinely low-priority issue despite the 'High' impact metrics in the vendor CVSS. The 6.7 base score is driven by C:H/I:H/A:H, but the vector itself (AV:L/AC:L/PR:H/UI:N/S:U) and the description both establish that the attacker must ALREADY hold System execution privileges to trigger the integer-overflow permission bypass - so the real-world delta is a narrow permission-boundary crossing from an already-highly-privileged context, not a jump from unprivileged code to root. The C/I/A:H marks are therefore generous; the marginal privilege gain over an existing System-level position is modest. EPSS agrees this is not a mass-exploitation concern at 0.12% (2nd percentile), there is no CISA KEV listing (no confirmed active exploitation) and no public POC. No SSVC decision data was provided. All signals are internally consistent (local, high-privilege prerequisite, low probability), so there is no CVSS-vs-description conflict to flag here - the only caveat is that the vendor impact scoring likely overstates the practical severity given the System-level precondition. |
| Exploit ScenarioDerived | A process or actor already running with Android System execution privileges (e.g. malware that has compromised a System-context service, or a malicious/abused privileged component) invokes the affected code paths with crafted values that trigger an integer overflow, causing a permission check to be bypassed. No user interaction is required. No public exploit code is identified at time of analysis, and there is no evidence of active exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
RemediationAI
Apply the vendor fix documented in the September 2026 Pixel security bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 - this is a Patch available per vendor advisory situation, meaning the bulletin is the source of record for the exact Pixel build and patch level that resolves the integer overflow, and no independent fix version is stated in the supplied data. For Pixel fleets, force an OTA check and confirm the device reports the September 2026 patch level; sideload the full OTA if carriers lag. There is no meaningful configuration workaround for a kernel permission bypass, so compensating controls should focus on the prerequisite rather than the flaw: treat System-level execution on the device as a high-value asset (restrict ADB, keep developer options off on managed devices, enforce locked bootloader and verified boot so a System context cannot be trivially obtained in the first place - trade-off is reduced field-debugging flexibility), and monitor for chained exploit behavior such as unexpected processes running with system or root-adjacent UIDs after any suspicious local compromise. Devices that cannot be patched promptly should be treated as unsuitable for high-assurance use, since blocking a port or disabling a feature cannot close a kernel-level restriction bypass once the attacker already holds PR:H.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-190, integer overflow, occurring in multiple locations within the Android kernel. A kernel-side overflow typically corrupts a size, offset, index or reference-count calculation used by an access-control or permission-checking path, so a caller that should be confined to its own privilege domain can instead satisfy a check it should fail and operate with elevated rights. This CVE is mapped to the Google Android CPE (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*) and, per the ENISA EUVD entry (EUVD-2026-78959), to the Android kernel, meaning the vulnerable surface is the kernel as shipped on Pixel devices by Google rather than an AOSP library or application component. It was reported by Google_Devices through the Android/Pixel security bulletin process, and the assessed vector - AV:L, AC:L, PR:H, UI:N, S:U - places it squarely in the local privilege-escalation class: reachable from a local context, low attack complexity, no user interaction, but gated behind an existing System-level execution context and unchanged in security scope. Because the actor must already be running as System, this does not grant an unprivileged app or a remote party any new foothold; its value in an attack chain is as a post-exploitation step that converts System execution into a broader kernel-level capability, which is also why the CVSS base score sits in the medium range despite high impact sub-metrics.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local integer-overflow permission bypass needing pre-existing System privileges (PR:H, AV:L), no UI; I retain C/I/A:H to match vendor though the marginal gain over System is modest.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB