EUVD-2026-93784
GHSA-3c8w-76h9-9835
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain System execution privileges locally
-
ExploitInvoke is_pd_allowed in gem_msg.c
-
ExecutionMissing permission check bypassed
-
ImpactDisclose restricted information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local attacker to already possess System execution privileges (CVSS PR:H); there is no remote or network vector and no user interaction. The specific defect is a missing permission check in the is_pd_allowed function of the gem_msg.c kernel source, so reaching it requires code execution in a System-privileged context that calls this path. Limiting factors that reduce realistic risk: the high pre-existing privilege requirement (this is an authorization gap behind an already-high trust boundary, not an initial-access bug), local-only reach, and impact confined to information disclosure (no integrity or availability impact). The flaw is likely confined to Android/Pixel builds shipping the affected gem_msg.c driver. |
| Impact | This is a moderate-severity, low-priority issue despite the CWE-862 authorization weakness. All signals point to constrained, non-urgent risk: the CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.4 MEDIUM) establishes that exploitation is local-only and requires PR:H - i.e., the attacker must already hold System execution privileges, which the description confirms ('System execution privileges needed'). CISA SSVC reinforces low urgency: Exploitation=none (no observed or expected exploitation), Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no POC referenced, so this is no public exploit identified at time of analysis. No EPSS score was provided, so statistical exploitation probability cannot be stated. The only meaningful conflict is tag-versus-description: the 'Authentication Bypass' tag overstates the issue, which is actually a missing authorization/permission check (CWE-862) reachable only post-privilege-escalation, with impact limited to local information disclosure (C:H, I:N, A:N). Net: a legitimately missing-permission-check bug, but the PR:H prerequisite and 'none' exploitation status make it a low real-world priority rather than an emergency. |
| Exploit ScenarioDerived | A process already running with System execution privileges on an affected Android device invokes the is_pd_allowed path in gem_msg.c, which is missing its permission check, and thereby reads restricted information it should not be authorized to access. No user interaction is required, but the attacker must first obtain System-level privileges. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
A missing permission check in the is_pd_allowed function of Android's gem_msg.c kernel source (CWE-862, Missing Authorization) allows an attacker who already holds System execution privileges to bypass an authorization decision and read otherwise-protected information. Impact is limited to local information disclosure - confidentiality-only (C:H) with no integrity or availability effect - and exploitation requires a local foothold running as System (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.4); no user interaction is needed. There is no public exploit identified at time of analysis, exploitation is assessed as non-automatable (SSVC Exploitation: none), and this is a low-priority, post-compromise authorization gap behind an already-high trust boundary rather than an initial-access bug. Google Devices reported the flaw and a fix is referenced through the Android/Pixel October 2026 security bulletin.
RemediationAI
Primary remediation is to apply the vendor fix delivered through the Android/Pixel security bulletin dated 2026-10-01 (https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01) - patch availability is per vendor advisory, and the bulletin should be consulted for the exact patched build identifiers, since no discrete fix version is enumerated in the supplied intelligence. There is no vendor-released standalone patch version identified outside that bulletin. Because exploitation requires an attacker to already run with System execution privileges and is local-only, the most effective compensating controls target the prerequisite rather than the endpoint: strictly limit which local processes, apps, or vendor components are granted System-level execution, and audit/grant-reduce any privileged service or test/debug component that can reach the gem_msg.c message path, accepting the trade-off that this may break legitimate privileged functionality. Where the affected driver path is not needed on a given device configuration, restricting or removing access to it (or ensuring SELinux never-permissive enforcement for the calling domain) narrows exposure, at the cost of potentially disabling dependent features. Standard hardening such as verified boot, keeping the device locked with a strong credential, and avoiding installation of untrusted privileged components reduces the likelihood an attacker can first obtain the System context this bug sits behind; none of these mitigations substitute for installing the bulletin update once it is available for the device.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect lives in gem_msg.c, part of the kernel-side messaging/transport code shipped on Android (Google/Pixel) builds, in the is_pd_allowed authorization helper. CWE-862 (Missing Authorization) describes the root cause precisely: the routine that decides whether an operation is permitted for a given protection domain ("pd") fails to perform the required permission check, so a caller that should have been denied proceeds. Because the affected path is reachable only from kernel/driver code executed in a System-privileged local context, the CVSS vector is AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - local attack vector, low complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact only. The vulnerability is not a memory-safety corruption (no write/exec primitive, hence no I or A impact); it is a logic/authorization gap whose practical consequence is that data belonging to one domain may be disclosed to a caller operating under System privileges. CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* confirms the affected product family is Android, with the flaw confined to builds shipping the affected gem_msg.c driver; EUVD classifies the affected component as the Android kernel.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Description states System execution privileges needed (PR:H) and local-only access (AV:L) with no UI; impact is pure information disclosure so C:H, I:N, A:N.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB