EUVD-2026-92611
GHSA-pw27-xg5h-q7h3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
DeliveryInvoke vulnerable component with crafted input
-
ExploitTrigger out-of-bounds write via bad bounds check
-
ExecutionCorrupt memory to gain system privileges
-
ImpactFull device compromise (C/I/A total)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have a local foothold - unprivileged code execution on the device, typically via an installed malicious or compromised app (PR:L). No user interaction is required (UI:N) and no non-default configuration is needed, but the local-only attack vector (AV:L) means the flaw cannot be triggered remotely over a network. The CVE description states 'no additional execution privileges needed' beyond that initial local foothold. Limiting factors: the attacker must first get code running on the target (app install or chained bug), exploitation is not automatable/scalable per SSVC, and the device must run an affected Android version (14 through 17, including 16-qpr2) without the October 2026 patch applied. |
| Impact | This is a locally-exploitable privilege escalation flaw (CWE-119 out-of-bounds write) in Android, rated CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N - confirming local attack vector, low complexity, requiring low privileges already held (an installed/malicious app), and no user interaction. All three impacts are High (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating indicating full system/kernel-level compromise once triggered. However, countervailing signals lower its real-world urgency: SSVC reports Exploitation 'none' (no observed or public exploitation), Automatable 'no' (cannot be reliably scaled/wormed, consistent with the local AV and the need for a pre-positioned app), the CVE is NOT in CISA KEV, and no public POC is referenced. EPSS is not provided in the input, so exploitation probability cannot be quantified. Net assessment: a genuinely serious local EoP that matters for defense-in-depth and chained exploits (e.g., sandbox escape after initial app compromise), but it is not a drop-everything internet-facing emergency - it is a high-CVSS issue whose real-world risk is tempered by the local-only vector, required foothold, and absence of any exploitation evidence. Patch via the October 2026 Android Security Bulletin on the normal monthly cadence. |
| Exploit ScenarioDerived | A user installs a malicious or compromised app, or an attacker leverages a separate initial-access bug to run unprivileged code on the device. That code invokes the vulnerable component with crafted input that fails the incorrect bounds check, triggering an out-of-bounds write to escalate from app-level to system/kernel privileges. No user interaction is required and no public exploit is currently identified, but the low attack complexity makes reliable exploitation plausible once details are reverse-engineered from the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Local privilege escalation in Google Android (versions 14, 15, 16, 16-qpr2, and 17) allows an attacker who already holds a local foothold to write outside intended memory bounds and elevate privileges to a higher-privileged context. The flaw is an incorrect bounds check producing an out-of-bounds write (CWE-119) in multiple locations, rated CVSS 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - exploitable by an unprivileged app on the device, with high complexity of preconditions but low attack complexity once a foothold exists, and no user interaction required. Exploitation is not automatable per the CISA SSVC assessment, no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV listing).
RemediationAI
The primary fix is to apply the October 2026 Android Security Bulletin update (https://source.android.com/docs/security/bulletin/2026/2026-10-01), which addresses this out-of-bounds write; admins and users should update to the vendor build carrying the 2026-10-01 patch level, and enterprise fleets should be validated against that patch level via their EMM/UEM console. Patch status is 'Patch available per vendor advisory' - an exact fixed build or component version is not provided in the supplied data, so consult the bulletin for the per-component version identifiers. Where the update cannot be applied immediately (legacy or out-of-support devices, or OEM builds not yet shipping the bulletin), compensating controls should focus on preventing the required local foothold: enforce Google Play Protect and verify apps at install, disable sideloading of applications from unknown sources and restrict installation to a managed allowlist via EMM policy, and remove or sandbox untrusted apps - noting that these measures reduce but do not eliminate risk, since exploitation could also be reached by chaining a separate local bug. For high-value or high-risk users, consider stricter app-install policies and device attestation/monitoring to detect anomalous privilege transitions, accepting the usability cost of tighter install restrictions. Because the flaw is local-only (AV:L) and not automatable, network-perimeter controls provide no meaningful mitigation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-119 (improper restriction of operations within the bounds of a memory buffer), manifesting as an out-of-bounds write resulting from an incorrect bounds check performed in multiple code locations on the Android platform. Memory-safety defects of this class allow data to be written past the end of an allocated buffer, which can corrupt adjacent memory structures and be shaped into controlled code execution or privilege escalation within the context of the vulnerable process. The affected product per CPE data is the Google Android platform itself (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), reported by the Google Android security team and addressed through the Android Security Bulletin rather than a single named third-party library. The attack surface is local: the assessed vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the flaw is reachable from a process already running on the device with low privileges - typically an installed malicious or compromised application - and cannot be triggered remotely over a network. Severity is scoped as unchanged (S:U) but with high confidentiality, integrity, and availability impact, reflecting the potential for full compromise of the affected component's data and execution flow. The specific vulnerable subsystem or driver is not enumerated in the supplied data beyond 'multiple locations' within Android.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector with an already-installed unprivileged app (PR:L), no user interaction, and an OOB write yielding full privilege escalation gives total C/I/A impact.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A memory-safety flaw in Google Android 14, 15, 16, 16 QPR2 and 17 allows an application that is already present on a device to escalate to a higher-privileged context, giving an attacker effective control over the handset's data and functions. No public exploit has been identified at time of analysis and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, but no vendor-released patch is identified at time of analysis, so every Android endpoint running these versions in the managed and BYOD estate stays exposed until Google ships a fix. Leadership should care because these devices hold corporate email, credentials and line-of-business applications, and a single compromised handset can become a beachhead into enterprise systems.
No vendor-released patch identified at time of analysis; interim mitigations are MDM/EMM-enforced app allowlisting and work-profile isolation, Play Protect and Verify apps enforcement, disabled sideloading and USB/ADB debugging, restriction of app install privileges for end users, prompt application of Google Play system updates, and enhanced endpoint logging/alerting for privilege-escalation or memory-corruption indicators, with unmanageable devices escalated for replacement or user-access restriction.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB