EUVD-2026-93788
GHSA-4hh3-8fqh-rqcv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to device
-
DeliveryAttach malicious Wacom HID peripheral
-
ExploitSend crafted report to wacom_hid_set_device_mode
-
ExecutionTrigger out-of-bounds kernel write
-
ImpactEscalate to kernel privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires physical access to the target device and the ability to attach or emulate a malicious Wacom HID peripheral that sends a crafted report processed by wacom_hid_set_device_mode in wacom_sys.c, where a missing bounds check permits an out-of-bounds write. No authentication (PR:N) and no user interaction (UI:N) are needed once the device is connected. Exploitation is strictly limited by the AV:P physical requirement - it cannot be performed remotely or at scale - and is only relevant on Android/Pixel devices whose kernel includes and exercises the Wacom HID driver. |
| Impact | Signals are consistent and point to a real-but-bounded risk. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8) describes an unauthenticated, no-interaction out-of-bounds write in the kernel Wacom HID driver that yields total compromise of the affected system - but only via the PHYSICAL attack vector (AV:P). CISA's SSVC decision data reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (physical access cannot be scripted at scale), Technical Impact=total (full kernel control). No KEV listing and no POC are present in the input, and no EPSS score was supplied. The combination - maximal technical impact gated behind physical device access, no automation, and no evidence of exploitation - makes this a targeted/opportunistic physical-access concern rather than a mass-exploitation priority. It is correctly treated as a routine monthly-patch item (Android/Pixel October 2026 bulletin) rather than an emergency. Note: EPSS is missing from the input, so probabilistic exploitation likelihood could not be cross-referenced; however, given AV:P and SSVC Automatable=no, a low EPSS would be expected and would not change the assessment. |
| Exploit ScenarioDerived | An attacker with brief physical access to an Android/Pixel device left unattended attaches a malicious or emulated Wacom HID peripheral that sends a crafted report. The missing bounds check in wacom_hid_set_device_mode triggers an out-of-bounds kernel write, corrupting kernel memory to escalate from the driver context to full kernel privileges. No public exploit identified at time of analysis, and no user interaction is required once the device is connected. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
An out-of-bounds write in the Android kernel's Wacom HID driver (wacom_hid_set_device_mode in wacom_sys.c) lets an attacker who can physically attach or emulate a malicious Wacom HID peripheral corrupt kernel memory and escalate privileges on the affected device. No authentication or user interaction is required once the peripheral is connected, because the crafted report reaches the driver's missing bounds check directly; the CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms a physical-access-only attack path with high confidentiality, integrity, and availability impact. Only Pixel/Android kernel builds that include and exercise the Wacom HID driver are affected, and there is no public exploit identified at time of analysis; CISA SSVC rates exploitation as none and automatable as no, so the practical risk is bounded by the strict physical-access requirement and the inability to exploit this remotely or at scale.
RemediationAI
Patch available per vendor advisory: apply the Android/Pixel security bulletin published at https://source.android.com/docs/security/bulletin/pixel/2026/2026-10-01 and install the updated over-the-air or factory image for the affected Pixel/Android device; the fixing build is the one identified in that bulletin, and no specific patch version should be assumed beyond what the advisory lists. If immediate patching is not possible, the most effective compensating control is to remove the attack surface: disable or blacklist the Wacom HID kernel module (e.g., prevent loading of the wacom/hid-wacom driver) on devices where Wacom peripherals are not needed, accepting the side effect that genuine Wacom tablet, pen, and stylus functionality will no longer work. Because exploitation is strictly physical (AV:P), restrict physical access to devices and enforce controls that block unauthorized USB/Bluetooth peripheral attachment - for example, disable USB peripheral/accessory support while locked, disable Bluetooth or auto-connect/bonding of unknown HID peripherals, configure USB port or gadget restrictions, and use device management policy to prevent untrusted HID devices from pairing. These measures reduce exposure but do not eliminate the flaw, and each carries trade-offs (loss of legitimate peripheral support, reduced user convenience), so patching remains the primary remediation. No public exploit code has been identified, but physical-access scenarios such as shared workstations, kiosks, and seized or loaned devices still warrant prioritizing the vendor update.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an improper restriction of operations within the bounds of a memory buffer (CWE-119) in the Linux-derived Android kernel's Wacom HID driver, reached through the function wacom_hid_set_device_mode in wacom_sys.c. Wacom peripherals communicate as HID devices over USB or Bluetooth, sending feature/report payloads that the driver parses; when a crafted report is processed by the device-mode handling path, the absence of a length/bounds validation allows data to be written past the end of the intended buffer. Because the code runs in kernel context, a successful write can corrupt adjacent kernel memory and be leveraged for privilege escalation. The attack surface is inherently constrained: it exists only on devices whose kernel configuration enables and binds the Wacom HID driver (e.g., CONFIG_HID_WACOM) and whose HID stack exposes the affected code path, which per the EUVD entry maps to the Android kernel as distributed in Google/Pixel builds (CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, all versions up to those carrying the vendor fix). The physical vector (AV:P) reflects that the attacker must be able to plug in or emulate the malicious peripheral; once that precondition is met, PR:N and UI:N mean nothing further is needed from the user. SSVC's 'total' technical impact rating is consistent with kernel-level memory corruption, while its 'Exploitation: none' and 'Automatable: no' ratings correctly capture that this cannot be triggered remotely or mass-exploited.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical HID-device attachment forces AV:P; no auth or interaction needed (PR:N/UI:N); kernel out-of-bounds write gives total C/I/A within an unchanged kernel scope.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB