EUVD-2026-78983
GHSA-cgrj-3489-fc6w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege code execution on device
-
ExploitInvoke VPU interface lacking permission check
-
ExecutionBypass permission enforcement (CWE-693)
-
ImpactEscalate to System execution privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Requires the attacker to already possess local, low-privilege code execution on the affected device (PR:L, AV:L) - for example a malicious or compromised app installed and running. Exploitation then targets the VPU (Video Processing Unit) component, which is missing a required permission check (CWE-693); no user interaction is needed (UI:N). Limiting factors: exploitation is local-only (no network vector), the device must expose the vulnerable VPU subsystem (the reference is a Pixel bulletin, so applicability likely centers on Pixel hardware rather than all Android devices despite the broad google:android CPE), and the flaw yields escalation only up to System - not full kernel/root - execution privileges. |
| Impact | This is a genuine but bounded local privilege-escalation issue, not a remote-critical emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) confirms exploitation requires local access and pre-existing low-level privileges (PR:L), so the attacker must already be running code on the device before leveraging the missing permission check (CWE-693) in the VPU to reach System execution privileges. All exploitation signals point away from urgency: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified. There is no SSVC data in the input. The signals are internally consistent - a low EPSS aligns with a local-only, privilege-requiring flaw that is not remotely automatable. The main caveat is scoping: the CPE string is the ubiquitous cpe:2.3:a:google:android:* wildcard, but the reference is a Pixel-specific security bulletin and the affected component (VPU) is a hardware-specific subsystem, so the practical exposure is narrower than the CPE implies - verify device applicability against the Pixel bulletin rather than assuming all Android devices. |
| Exploit ScenarioDerived | A malicious or compromised app already running on a Pixel device with low-level privileges invokes the VPU interface directly, which fails to enforce a required permission check. By abusing this missing check the app escalates to System execution privileges without any user interaction. No public exploit code is known, and local code execution on the target device is a prerequisite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Local privilege escalation in the Android VPU (Video Processing Unit) component lets an attacker who already holds low-privilege code execution - such as a malicious or compromised app running on the device - bypass a missing permission check and elevate to System-level execution privileges, with no user interaction required. The flaw is assessed at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and was reported by Google Devices against the Pixel security bulletin, so real-world exposure centers on Pixel hardware that exposes the affected VPU subsystem rather than all devices matching the broad google:android CPE. EPSS is only 0.12% (2nd percentile) and no public exploit identified at time of analysis; impact is bounded to System privileges, not full kernel or root.
RemediationAI
Patch status: Patch available per vendor advisory - apply the Google Pixel security bulletin for September 2026 (https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01) and update to the corresponding Android security patch level; no exact fixed build or kernel version string is provided in the available data, so consult the bulletin's build table for your specific Pixel model instead of assuming a version. Until the device is patched, the practical compensating control is to break the PR:L precondition: restrict app installation to trusted sources and keep Google Play Protect and sideloading restrictions enabled, since the vulnerability cannot be triggered without a local low-privilege code-execution foothold - the trade-off is reduced flexibility for testing or enterprise-sideloaded apps. Disabling USB debugging and developer options on managed or high-value devices further reduces the routes by which an attacker could plant the initial payload, at the cost of developer convenience. There is no network-facing mitigation to apply because the vector is local-only, and no configuration switch for the VPU subsystem is documented in the available references as a supported workaround.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The VPU (Video Processing Unit) is a dedicated hardware block for video encode/decode and related media processing that is exposed to userspace through a vendor driver interface. CVE-2026-56982 is classified as CWE-693 (Protection Mechanism Failure): the VPU interface is missing a required permission check, so a caller that should have been rejected can reach functionality intended only for higher-privileged components. The attack is strictly local (AV:L) with a PR:L requirement, meaning the adversary must first obtain low-privilege code execution - typically a malicious app - before invoking the inadequately gated VPU operations; UI:N confirms no additional user action is needed once that foothold exists. The CPE cpe:2.3:a:google:android:* with a wildcard version, combined with the AOSP Pixel bulletin reference and the EUVD affected-version entry (Android Android kernel), indicates the flaw lives in Android platform/vendor VPU driver code shipped in Pixel builds rather than in a single named app. The vulnerability type is a permission-check bypass rather than memory corruption, and the assessed outcome is escalation to System execution privileges only.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with pre-existing low privileges (AV:L/PR:L), no interaction, missing check reliably bypassed (AC:L); escalation to System grants full C/I/A within an unchanged scope.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A high-severity local privilege escalation vulnerability in the Android VPU component affects Google Pixel devices, allowing a malicious app to gain System-level privileges without user interaction. While no public exploit identified at time of analysis and exploitation requires a pre-existing low-privilege compromise, the lack of a vendor patch means organizations with Pixel fleets should prioritize mitigation to prevent potential data exposure and unauthorized access to system resources.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing strict app installation controls (e.g., allowlisting, disabling sideloading), deploying mobile threat defense to detect and block malicious apps, enabling Google Play Protect, and monitoring for unusual System-level activity. Additionally, consider SELinux policy hardening to restrict VPU access if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB