EUVD-2026-79159
GHSA-454f-g2fw-hfr4
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local unprivileged app reaches the VPU driver with no user interaction (AV:L/PR:N/UI:N); an OOB write yielding kernel/system EoP justifies C:H/I:H/A:H, matching the vendor.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
An out-of-bounds write in the Wave6 VPU video-decoder driver (Wave6VpuDecFlush in wave6.c) lets an unprivileged local app corrupt kernel memory on affected Android devices, escalating to kernel-level privilege and full device compromise. The flaw requires local code execution - an attacker must already be able to run code on the device and reach the decoder's flush routine - but needs no user interaction and no prior elevated privileges (AV:L, PR:N, UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local code execution on an affected Android/Pixel device - the attacker must already be able to run an app (even unprivileged) that can reach the Wave6 VPU video-decoder driver's flush routine (Wave6VpuDecFlush in wave6.c); this generally means the device uses the Chips&Media WAVE6-class VPU present on the affected Pixel/Tensor hardware. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but locally-scoped privilege-escalation flaw, not an internet-facing emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary remediation is to apply the vendor security update for this issue: install the Android/Pixel security patch level that incorporates the September 2026 Pixel bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01), which is where Google publishes the fix for the wave6.c flush path; an exact patched build identifier is not provided in the available data, so confirm the correct build for each device model against that advisory rather than assuming a generic version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, instruct device owners and mobile operations teams to treat this as an unpatched kernel-level local privilege-escalation issue: confirm exposure by identifying which fleet models and chipset revisions use the Wave6 VPU decoder, and raise mobile threat-defense coverage to block sideloaded and untrusted-source applications, which are the primary delivery path for the local code execution this flaw requires. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today