Privilege Escalation

Privilege escalation and arbitrary code execution affect Netskope Endpoint DLP (EPDLP) on Windows, where a privileged local user can send a crafted message to the EPDLP inter-process communication port to trigger a CWE-190 integer overflow, corrupting process memory. The vulnerability is gated behind two explicit non-default conditions - the EPDLP module must be active in the client configuration, and Windows Memory Integrity (HVCI/VBS) must be disabled on the host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Container escape in IBM Aspera Enterprise WebApps 1.0.0-1.0.5 allows a local attacker with low privileges inside the container to break out to the underlying host due to unrestricted system call access. The CVSS vector (S:C/C:H/I:H/A:H) reflects full host compromise as the post-escape impact, not merely container-level damage. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; IBM has released a patch.

Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.

Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis.

Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-of-use race condition during backup restore allows an attacker to abuse insecure symlink following and take ownership of arbitrary files or directories. A low-privileged Plesk account holder who wins the race can redirect a root-executed restore operation onto attacker-chosen paths, gaining full root control of the hosting server. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Local privilege escalation in gvfs's privileged gvfsd-admin daemon affects Red Hat Enterprise Linux 6 through 10, allowing an authenticated local attacker to obtain root access. The daemon's use of symlink-following chown() on attacker-controlled directory paths creates a TOCTOU window during D-Bus socket setup. By racing the operation and substituting a symlink to a root-owned file such as /etc/pam.d/su, an attacker causes the daemon to transfer ownership of that critical file to the attacker's UID, enabling subsequent modification and full privilege escalation to root.

Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.

OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to execute 26 of 29 write operations that should be restricted to higher-privileged roles. Affected actions include deleting reports and dashboards, scheduling entire projects for deletion, publishing private analytics to public share links, and modifying alerting rules - all achievable by any user with the lowest valid project membership tier. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; organizations should consult GitHub Security Advisory GHSA-f9rx-pxgw-c6rg for patch details.

Privilege escalation in capgo.app (npm package `capgo` ≤ 12.207.1) allows an authenticated org_member to promote an external account to org_admin or org_billing_admin by exploiting a missing role-rank comparison in the `validateInvite()` function of the invite-new-user Edge Function. The invitation-acceptance path compounds the issue by using the Supabase service-role key, which bypasses two dedicated database triggers designed to enforce privilege boundaries, resulting in full administrative control over the organization's apps, channels, members, and billing. No public exploit is identified at time of analysis; an upstream fix is available via PR #3096.

Container escape in crun >= 1.29, when built with libkrun and started rootful with passt networking (krun.use_passt), allows an attacker who controls the container image to execute arbitrary code with host root privileges. This is a regression introduced in crun 1.29, meaning environments that recently upgraded are at risk while those on earlier versions are not. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation yields full host compromise via container escape.

Privilege escalation in the Registration Form for WooCommerce WordPress plugin (versions before 1.1.3) allows any authenticated Contributor-level user to register new WordPress accounts with arbitrary roles, including Administrator. The plugin fails to verify that the form ID supplied during registration belongs to a legitimate registration form, instead blindly reading the permitted-role allow-list from any post the attacker controls. Exploitation results in full site takeover. A publicly available proof-of-concept exists. This vulnerability is an incomplete fix of a prior privilege escalation issue tracked as CVE-2026-54807.

Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.

Improper privilege management in Open WebUI 0.10.0 through 0.11.0 allows any authenticated low-privilege user with write access to a knowledge base to delete administrator-owned external connection configurations shared across the entire instance. The DELETE /api/v1/knowledge/{id}/delete endpoint in knowledge.py correctly validated the user's write access to their own knowledge base but then cascaded the delete to the underlying shared external connection without verifying admin role or checking whether other knowledge bases depended on that connection. This means a single non-admin user can render all other knowledge bases on the instance that share the same external vector store connection permanently unavailable. No public exploit has been identified at time of analysis; vendor-released patch is available in version 0.11.1.

Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context.

Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to bypass authorization controls by replaying signed Livewire component snapshots directly against the /livewire/update endpoint. Because authorization is enforced only at the HTTP route layer and not within Livewire component lifecycle methods, a low-privilege session holder can invoke protected admin operations including creating OAuth clients, minting personal access tokens, and reading sensitive administrative data. No active exploitation has been confirmed (no CISA KEV listing), but the vendor-confirmed fix is available in version 8.7.0.

Privilege escalation in the Portworx Operator on Red Hat OpenShift (OCP) allows a low-privileged, namespace-scoped user to cause the operator to assign cluster-wide permissions beyond what the user was authorized to hold. The flaw (CWE-266, Incorrect Privilege Assignment) is constrained to the initial provisioning phase of a Portworx storage cluster, meaning the exploitation window is finite but deliberate timing by an insider or a compromised account could reliably hit it. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 7.7 reflects high confidentiality, integrity, and availability impact when the specific provisioning condition is met.

Local privilege escalation in ESET AV Remover (standalone) enables a low-privileged local user to attain SYSTEM-level control by sending specially crafted RPC messages to the tool's privileged service component. The root cause is CWE-269 (Improper Privilege Management): the RPC handler fails to enforce access controls commensurate with the operations it exposes, allowing an unprivileged caller to invoke functionality that executes at a higher privilege level. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

Privilege escalation in YITH WooCommerce Waitlist Premium for WordPress (versions ≤3.35.0) allows any subscriber-level authenticated user to manufacture a new WordPress administrator account, achieving full site takeover. The vulnerable AJAX handler add_user_in_waiting_list() is exposed to all logged-in users with no nonce or capability check, and applies parse_str() plus extract() to attacker-supplied POST data before passing the injected variables directly to wp_create_user() and $user->set_role(). No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack mechanics are trivially derivable from the Wordfence disclosure.

Privilege escalation in PublishPress Capabilities WordPress plugin (all versions ≤2.50.0) allows authenticated Editor-level users to elevate to site-wide capability managers without administrator consent. The root cause is a hard-coded role assignment in `addPluginCapabilities()` that unconditionally grants the Editor role all 15 `manage_capabilities_*` capabilities on the first `admin_init` hook after plugin activation, writing the grants persistently to the WordPress database. Once escalated, an Editor can create, rename, and delete non-system roles; modify capabilities of non-administrator roles; restore role backups; and write arbitrary plugin options under several namespaced prefixes - stopping short of full Administrator access only because WordPress's `map_meta_cap` layer blocks further escalation. No public exploit or CISA KEV listing identified at time of analysis.

WP EasyCart (Shopping Cart & eCommerce Store) versions up to and including 5.9.3 exposes a privilege escalation path allowing authenticated Store Manager-level users to promote themselves to WordPress administrator. The `ec_ajax_save_page_default_options()` AJAX handler accepts arbitrary POST parameters and writes them directly to the WordPress options table via `update_option()` without any allowlist, while its nonce is embedded in frontend product and category templates accessible to any user holding the plugin's custom 'wpec_manager' capability. No public exploit code has been identified at time of analysis, but the attack technique is mechanically straightforward and requires only a Store Manager credential to execute.

Remote code execution in FireBox - WooCommerce Popup Builder (all versions ≤ 3.1.10) allows authenticated Author-level attackers to execute arbitrary PHP on the server by injecting unsanitized PHP expressions into campaign condition rules via the `firebox_meta` REST endpoint. The plugin's `Executer::allowedToRun()` blacklist (Executer.php L231) uses a trivially bypassable regex that permits WordPress core functions such as `wp_insert_user`, `update_option`, and `file_put_contents`, which the `value` function in the PHP Conditions class then evaluates directly. Critically, sites migrated from any version prior to 3.1.10 are automatically subjected to `Migrator::preserveCampaignRoleAccess()`, which grants Author-role users `edit_fireboxes` and `publish_fireboxes` capabilities, making exploitation reachable from any registered Author account with no further privilege requirements. No public exploit code or CISA KEV listing has been confirmed at time of analysis.

Privilege elevation in Chrome's WebUI component prior to version 153.0.8010.36 enables sandbox escape and arbitrary code execution outside the browser sandbox when the renderer process has already been compromised. This is a second-stage, chained exploit: an attacker must first achieve renderer-level code execution (e.g., via a separate renderer bug) and then leverage this WebUI flaw (CWE-250 - execution with unnecessary privileges) to break out of the sandbox. No public exploit code has been identified and no CISA KEV listing exists; SSVC rates automatable exploitation as 'no', consistent with the multi-step chain requirement.

Local privilege escalation in Waves Central for macOS (versions up to 16.6.2) allows any authenticated local user to gain root code execution by abusing a flawed XPC client authorization scheme in the product's privileged helper service. The helper validates connecting XPC clients by performing a certificate-chain equality comparison against itself rather than enforcing a pinned code requirement (application identifier and Apple Team ID), meaning any process carrying the Waves signing certificate can impersonate a legitimate client and instruct the helper to run arbitrary scripts as root. No public exploit has been identified at time of analysis; a vendor-released fix is available in version 17.0.

Privilege escalation in Adobe Acrobat Reader and Adobe Acrobat (all editions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows a low-privileged local attacker to gain full elevated access via an Incorrect Authorization flaw (CWE-863). The CVSS scope-change indicator (S:C) with C:H/I:H/A:H confirms the vulnerability crosses a privilege boundary beyond Acrobat's own security domain - almost certainly compromising the underlying OS context. No user interaction is required, enabling silent exploitation once a foothold is established. No public exploit code or CISA KEV listing has been identified at time of analysis.

Privilege escalation and local code execution affect the OpenTelemetry.Resources.Host NuGet package (opentelemetry-dotnet-contrib) on macOS prior to version 1.16.0-beta.2. The host.id resource attribute detector invokes sh and ioreg using bare names resolved through the PATH environment variable rather than absolute paths, allowing a local attacker with fewer privileges than the host application to substitute malicious binaries and execute arbitrary code in the application's security context. No public exploit has been identified at time of analysis; Linux and Windows hosts are explicitly unaffected.

Local privilege escalation in Maono Link 3.8.13 on Windows enables any standard user account to gain elevated service-level privileges by writing a malicious payload to C:\ProgramData\Maono. The MaonoAiServices Windows service runs with elevated OS privileges while leaving its data directory writable by unprivileged local users - a classic insecure service directory permission pattern (CWE-428). Vendor patch 4.0.80 is available; no public exploit has been identified at time of analysis.

Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a party to an active remote session push and run files on the Host machine without authorization or the Host's confirmation under certain circumstances. This turns a legitimate support session into a code-execution channel against the remote endpoint; ScreenConnect servers are explicitly not affected. No public exploit identified at time of analysis, though the client's remote-support role makes it an attractive target.

Privilege escalation in Okta Hyperdrive Integration Plugin (versions 1.2.0 through pre-1.5.2) stems from the plugin resolving a .NET assembly path via the current user's HKCU registry hive and loading it with Assembly.LoadFrom without any signature or integrity check. A local attacker with standard user privileges who can write to the relevant HKCU registry key can redirect the load path to a malicious DLL, which then executes within the host process or elevated installer context - achieving privilege escalation beyond the attacker's normal trust boundary. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Local information disclosure in Android Wear (Wear OS) versions 14, 16, and 17 lets a co-resident application read sensitive device state data because checkReadPermission in PermissionsManager.java fails to enforce a required permission. No additional execution privileges or user interaction are needed, so any installed app can silently monitor protected state. No public exploit identified at time of analysis, and the flaw is fixed in the September 2026 Wear security patch level.

Local privilege escalation in Android XR 14's MicroXR Blobstore component lets a co-resident malicious app read files belonging to other applications because a required permission check is missing. Any app installed on the device can exploit it with no user interaction and no elevated privileges, exposing another app's stored blobs. No public exploit identified at time of analysis; this is a Google/Android XR platform issue tracked in the September 2026 Android XR security bulletin.

Incorrect Authorization (CWE-863) in Adobe Commerce and Magento Open Source allows unauthenticated remote attackers to escalate privileges and gain write access to restricted platform resources without user interaction. Scope change is confirmed: successful exploitation crosses privilege boundaries within the Commerce platform, granting access to administrative or otherwise protected functionality. SSVC classifies technical impact as total and the attack as automatable, elevating operational priority despite no active exploitation currently recorded in CISA KEV.

Incorrect Authorization in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B allows remote unauthenticated attackers to bypass access controls and read sensitive platform data, achieving a privilege-escalation effect without any user interaction. The flaw stems from CWE-863 (Incorrect Authorization), where authorization checks fail to enforce the correct permission boundaries, letting an unauthenticated network request access resources restricted to higher-privilege roles. No public exploit code has been identified at time of analysis, but the combination of PR:N and C:H on a major e-commerce platform makes this a meaningful exposure for confidential business and customer data.

Incorrect Authorization in Adobe Commerce allows remote unauthenticated attackers to escalate privileges and access sensitive information without any user interaction. The vulnerability, rooted in CWE-863, affects Adobe Commerce 2.4.4 through 2.4.9, Magento Open Source 2.4.6 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3, covering a broad range of production deployments. No public exploit code has been confirmed and CISA KEV does not list active exploitation, but SSVC flags the flaw as automatable, raising concern for mass-scanning campaigns against exposed storefronts.

Local privilege escalation in the Android kernel's IOMMU subsystem (iommu.c) allows any process with basic user-level execution to gain full kernel privileges through out-of-bounds memory read/write triggered by improper input validation across multiple functions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required, making this a reliable local privilege escalation primitive for post-compromise chains or malicious apps. Google patched this in the Android Security Bulletin for September 2026 with two upstream kernel commits; no public exploit has been identified at time of analysis.

Privilege escalation in Android's SmsController affects versions 14, 15, 16, and 16-QPR2 due to missing permission checks across multiple functions. A locally-running application with basic privileges can invoke these unguarded entry points to gain full read, write, and availability impact on the device without any user interaction. No public exploit or active KEV listing exists at time of analysis; Google addressed this in the September 2026 Android Security Bulletin.

Local privilege escalation in the Android common kernel's alloc.c memory allocation functions allows a low-privileged local user to gain full read/write access to kernel memory via a race condition. Multiple functions in alloc.c are affected, with successful exploitation yielding complete confidentiality, integrity, and availability compromise of the device. The vulnerability requires no user interaction and no elevated privileges beyond an existing local shell; Google addressed it in the September 2026 Android Security Bulletin with a patch committed to the Android common kernel repository.

Local privilege escalation in the Android kernel's KVM IOMMU subsystem allows a low-privileged user to gain full kernel control via a use-after-free condition in kvm_iommu_map_sg (iommu.c). The root cause is a missing permission check that enables memory to be accessed after it has been freed, allowing an unprivileged local process to achieve read/write/execute control over the kernel. No public exploit has been identified at time of analysis, but Google's September 2026 Android Security Bulletin confirms the issue and provides a kernel patch via android.googlesource.com.

Local privilege escalation in Android's MountRegistry component across Android 14, 15, 16, and 16-qpr2 allows a low-privileged process to achieve full device compromise via a buffer overflow in the forEachLine function of MountRegistry.cpp. The flaw triggers an out-of-bounds read that can corrupt adjacent memory, enabling an attacker to elevate from a sandboxed app or low-privilege process to a higher system privilege level without any user interaction. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total.

Local privilege escalation in Android 17's STMicroelectronics NCI (NFC Controller Interface) driver allows a low-privileged local process to gain full system-level control via a missing bounds check in `stpropnci_process_std()` of `stpropnci_std.cc`. The missing input validation triggers a CWE-120 buffer overflow, achieving C:H/I:H/A:H impact with no user interaction required. No public exploit has been identified at time of analysis per SSVC exploitation status 'none,' though the SSVC Technical Impact is rated 'total.'

Local privilege escalation affects Android versions 16, 16-qpr2, and 17 via heap-based buffer overflow triggered by integer overflow in multiple framework locations. An attacker with basic local code execution (low-privileged app or shell) can exploit the memory safety flaw - requiring no additional privileges or user interaction - to gain full control of the device, compromising confidentiality, integrity, and availability. No public exploit or active exploitation is identified at time of analysis; EPSS of 0.12% (2nd percentile) indicates low probability of near-term observed exploitation.

Heap buffer overflow in Android's HEVC decoder (`ihevcd_get_tu_data_size` in `ihevcd_utils.c`) enables local privilege escalation across Android 14 through Android 17 with no additional execution privileges or user interaction required. A low-privileged attacker - such as a malicious application - can craft HEVC video input that triggers an out-of-bounds write on the heap, corrupting adjacent memory structures and ultimately gaining elevated device privileges. No public exploit code has been identified at time of analysis, and SSVC currently rates active exploitation as none, though the technical impact is classified as total.

Out-of-bounds write in Android's openLogicalChannel function across multiple telephony-related files enables local privilege escalation on Android 16 and 17 without requiring elevated permissions or user interaction. An attacker running as a low-privileged app can supply oversized input to a missing bounds check, corrupting adjacent memory and achieving full C:H/I:H/A:H system impact per CVSS. No public exploit has been identified at time of analysis; SSVC rates technical impact as total while exploitation status remains none.

Local privilege escalation in Android 16, 16-QPR2, and 17 stems from improper input validation in the AppendCommentLine function of AnnotationProcessor.cpp. A low-privileged local attacker can exploit this CWE-20 flaw without user interaction to achieve full confidentiality, integrity, and availability impact, consistent with a complete privilege escalation on the device. Google's Android Security Bulletin for September 2026 (2026-09-01) addresses this issue; the description's explicit 'supply chain risk' framing is atypical and suggests the vulnerable code participates in a build or annotation-processing pipeline where malicious input could propagate into compiled artifacts.

Heap-based buffer overflow in parseParts of PduParser.java enables local privilege escalation across Android 14 through 17 (including Android 16-QPR2). A low-privileged process on the device can trigger an out-of-bounds read via a malformed PDU, corrupting heap memory to achieve full confidentiality, integrity, and availability compromise without requiring user interaction. No public exploit code or KEV listing has been identified at time of analysis.

Local privilege escalation in Android 17 and Android 16-qpr2 stems from integer overflow vulnerabilities across multiple code locations, enabling out-of-bounds writes. A low-privileged local process or application can exploit these flaws without additional execution privileges or user interaction to gain full control over the device. No public exploit has been identified at time of analysis, and SSVC signals no current exploitation activity, but technical impact is rated total.

Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.

Out-of-bounds write vulnerabilities in multiple Android system functions allow a local, low-privileged attacker to escalate to root on Android 16-QPR2 and Android 17 without requiring any user interaction. The root cause is integer overflow (CWE-787) that underestimates buffer allocation size, enabling memory writes beyond allocated regions and corruption of privilege-sensitive data structures. The September 2026 Android Security Bulletin addresses these issues, and no public exploit has been identified at time of analysis.

Local privilege escalation in Android's package installer component allows a low-privilege app to push unauthorized updates to other installed applications by exploiting a permissions bypass in InstallRepository.kt. Affected versions are Android 17 and Android 16-qpr2, as disclosed in the September 2026 Android Security Bulletin. No user interaction is required for exploitation; SSVC signals no confirmed active exploitation and EPSS sits at 0.13%, indicating limited real-world activity at time of analysis.

Out-of-bounds write in Android's NFC MIFARE Classic read handler (`rw_mfc_handle_read_op` in `rw_mfc.cc`) enables a local low-privileged process to escalate to higher execution privileges with no user interaction. The flaw spans Android 14, 15, 16, 16-QPR2, and 17, covering the full range of currently supported Android releases. Google addressed this in the September 2026 Android Security Bulletin; no public exploit code has been identified at time of analysis.

Local privilege escalation in Android 17's telephony stack allows a low-privileged app to achieve arbitrary code execution without user interaction. The logic error in the serviceClassExists method of InCallController.java (CWE-693, Protection Mechanism Failure) enables an attacker with local shell or app access to elevate privileges to those of the telecom service process, gaining full read, write, and execution control. No public exploit exists at time of analysis, and SSVC assesses exploitation as none, though the technical impact is rated total.

Heap buffer overflow in the `read_boot_region` function of Android's filesystem check utility (`fsck.c`) allows a local, low-privileged process to escalate privileges with full system impact. The flaw spans Android 14 through 17 (including QPR2 branches) and was disclosed in Google's September 2026 Android Security Bulletin. No public exploit code has been identified at time of analysis, and EPSS signals a very low current exploitation probability.

Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.

Local privilege escalation in Android's biometrics settings framework (BiometricsSettingsBase.java) allows a low-privileged app to achieve full device compromise without user interaction. The confused deputy flaw (CWE-441) in the component's onAttach lifecycle method enables a malicious app to cause the biometrics settings service - which operates with elevated system privileges - to perform privileged operations on the attacker's behalf, bypassing authentication controls. Affects Android 14, 15, 16, 16-qpr2, and 17; no public exploit or CISA KEV listing identified at time of analysis.

Heap buffer overflow in Android's Bluetooth A2DP Opus vendor codec decoder allows a local low-privileged attacker to escalate privileges with no user interaction required. The flaw resides in `a2dp_vendor_opus_decoder_decode_packet` within `a2dp_vendor_opus_decoder.cc`, where a crafted Opus-encoded audio stream can trigger an out-of-bounds write on the heap. Affected versions span Android 14 through Android 17; no public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none.

Local privilege escalation in Android's memory allocator affects versions 14 through 17, enabling a low-privileged process to gain elevated system privileges without any user interaction. The root cause is a logic error in the LimitRealloc function within malloc_limit.cpp that produces a use-after-free condition, granting full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.12% (2nd percentile), though the SSVC framework rates technical impact as total.

LocalImageResolver.java in Android 14 through 17 (including QPR2 releases) contains a DNG image rendering authorization check bypass (CWE-863) that enables remote privilege escalation with full confidentiality, integrity, and availability impact. The flaw requires only low-level privileges and no user interaction, expanding the attack surface beyond typical media-processing vulnerabilities that normally depend on explicit user file-opening. Google's Android Security Team disclosed the issue via the September 2026 Android Security Bulletin; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in Android's runtime image writer (WriteImageToDisk, runtime_image.cc) allows a low-privileged local process to tamper with files through a logic error, potentially gaining full system control. Affected versions span Android 14 through Android 17, including the Android 16-QPR2 branch, making this a broad-impact flaw across the current and future Android release train. No public exploit has been identified at time of analysis, and SSVC indicates exploitation is currently none, but the Technical Impact rating of 'total' underscores the severity if exploited.

Background Activity Launch (BAL) bypass in Android's LauncherAppsService allows a low-privilege local application to launch foreground activities from the background without user awareness or interaction. The flaw resides in `buildIntentSenderForUser` within `LauncherAppsService.java`, where authorization checks (CWE-863) are insufficient to prevent background callers from obtaining a valid intent sender that sidesteps Android's BAL restrictions. Affected versions include Android 16, Android 16-QPR2, and Android 17; no public exploit identified at time of analysis.

Factory Reset Protection (FRP) in Android 14 through 17 can be bypassed via a logic error in `findMetaAuthUid` within `AccountsDb.java`, allowing a local attacker with minimal privileges to gain full control of a device without additional permissions or any victim interaction. All currently supported Android major versions are confirmed affected per Google's September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, though the total CIA impact (C:H/I:H/A:H) means successful exploitation yields complete device compromise.

Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.

Tapjacking vulnerability in Android's DeviceAdminAdd.java enables a locally-installed malicious application to render a transparent overlay over the device administrator enrollment screen, coercing users into unknowingly granting device admin privileges. Affected versions span Android 14, 15, 16, and 16-QPR2, covering a broad swath of current Android devices. Successful exploitation grants the attacker app full device administrator rights, enabling complete confidentiality, integrity, and availability compromise of the victim device. No public exploit exists and EPSS is at the 2nd percentile; SSVC rates technical impact as total but exploitation as none.

Background activity launch bypass in Android's RemoteViews framework allows a locally installed malicious application with basic user privileges to escalate to full device compromise without user interaction. Multiple functions in RemoteViews.java contain a logic error (CWE-693) that defeats Android's background activity launch (BAL) protection mechanism, enabling unprivileged apps to launch foreground activities from background context. Affecting Android 14, 15, 16, 16-QPR2, and 17, this has broad attack surface across the Android ecosystem; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.

Local privilege escalation in Android's Window Manager Service (WindowState.java) allows a low-privileged app to bypass overlay protection mechanisms across Android versions 14 through 17. The logic error in setHiddenWhileSuspended permits unauthorized overlay windows to remain visible or interact with the display even when they should be hidden for suspended apps, creating a pathway to full CIA compromise on the device. No public exploit has been identified at time of analysis, and EPSS scores the exploitation probability at just 0.13% (3rd percentile), though SSVC rates technical impact as total.

Local privilege escalation in Android 14 through 16 allows a low-privileged application to gain full system-level access by exploiting a confused deputy flaw in the ActivityTaskManagerService. The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java, where the service can be manipulated into exercising its elevated permissions on behalf of an unprivileged caller, bypassing Android's permission model. No additional execution privileges or user interaction are required, and no public exploit has been identified at time of analysis.

Privilege escalation in Android's ActivityStarter component (Android 14 through 16-qpr2) allows a locally-installed application with standard permissions to launch background activities outside Android's background launch restrictions, achieving full device compromise. The flaw resides in the executeRequest method of ActivityStarter.java, where a logic error fails to properly enforce the protection mechanism (CWE-693) that prevents unauthorized background activity launches. No public exploit has been identified at time of analysis; EPSS stands at 0.12% (2nd percentile), consistent with the SSVC exploitation status of none.

Local privilege escalation in Android's NFC stack affects devices running Android 14 through 17 via an out-of-bounds write triggered by a logic error in rw_mfc_handle_read_op, the MiFare Classic card read-operation handler in rw_mfc.cc. An attacker holding low-privilege local code execution can corrupt adjacent memory and escalate to higher system privileges with no additional privileges or user interaction required. No public exploit code has been identified and EPSS sits at 0.14% (4th percentile), but the five-release breadth of affected versions spans the bulk of the active Android install base, making this a meaningful patch target.

Privilege escalation in Android's PickActivity allows any installed low-privileged application to silently bypass the 'Install unknown apps' security restriction, enabling unauthorized APK installation without user consent across Android 14, 15, 16, and 16-QPR2. The root cause is a confused deputy flaw (CWE-441) in the setupLayout method of PickActivity.java, where the privileged activity can be manipulated into performing installation actions on behalf of a less-privileged caller, circumventing a core Android security boundary. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H scoring across all current Android releases.

Local privilege escalation in Android's telephony stack allows a low-privilege app to send USSD requests without the required telephony permission, bypassing Android's permission model through a logic error in handleUssdRequest of PhoneInterfaceManager.java. Affected releases span Android 14 through 17 including the 16-QPR2 branch, with no user interaction required post-installation. USSD access can reach carrier-side services capable of triggering sensitive device operations, making a successful exploit a pathway to full device compromise.

Privilege escalation in Android's cross-profile intent-forwarding mechanism (IntentForwarderActivity.java) allows a locally installed low-privilege application to bypass the user consent dialog presented by buildMiniResolver via a tapjacking or overlay attack, achieving full confidentiality, integrity, and availability impact across Android 14 through 17 including the QPR2 train. The vendor explicitly states no user interaction is required, indicating the consent bypass is mechanically triggered against the framework rather than requiring the victim to tap attacker-crafted UI. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.12% (2nd percentile) and SSVC Automatable=no confirm no observed mass exploitation.

Intent redirection in Android's SetupPassthroughActivity allows a locally present, low-privilege attacker to launch arbitrary activities and escalate privileges to a higher-trust system level. Affecting Android 14 through 17 (including 16-qpr2), the flaw resides in the onCreate method of SetupPassthroughActivity.java and requires user interaction to trigger. No public exploit is identified at time of analysis, and an EPSS of 0.11% (2nd percentile) indicates minimal current exploitation probability, consistent with the SSVC exploitation-none signal.

Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.

Local privilege escalation in Android 16 through 17 exploits incorrect authorization (CWE-863) across multiple URI access control locations, allowing a low-privileged process to bypass permissions checks and achieve full read/write/execute access on the device without requiring user interaction. Reported by security@android.com and addressed in the September 2026 Android Security Bulletin, the flaw affects Android 16, Android 16-QPR2, and Android 17. No public exploit has been identified and EPSS sits at the 2nd percentile, though SSVC rates the technical impact as total.

Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.

Local privilege escalation in Android's Slice permission subsystem allows a low-privileged installed application to bypass permission checks via a confused deputy flaw in SlicePermissionActivity.java's onCreate method. Affecting Android 14 through 17 (including the 16-QPR2 branch), the vulnerability requires no user interaction and grants full C:H/I:H/A:H impact on a successful device. No public exploit has been identified at time of analysis, and EPSS scoring (0.12%, 2nd percentile) reflects low current exploitation activity.

Local privilege escalation in Android's ChannelImpl.java allows a low-privileged installed application to launch arbitrary intents by exploiting improper input validation in the initAppLinkTypeAndIntent method. Affected versions span Android 14 through 17, including 16-QPR2. Exploitation requires user interaction, limiting automated attack at scale - SSVC confirms no observed exploitation and EPSS sits at 0.11% (2nd percentile), consistent with the local-access, user-interaction gating.

Local privilege escalation in Android 16, 16-QPR2, and 17 is possible via Intent Redirection by exploiting a logic error in ActivityStarter.java's resolveActivity method. A locally-installed malicious application with basic user privileges can craft or intercept Intents to gain unauthorized access to protected system components, achieving full confidentiality, integrity, and availability compromise of the device without requiring any user interaction after installation. EPSS is 0.12% (2nd percentile) and no active exploitation or public POC has been identified at time of analysis.

Silent NFC payment session hijacking in Android 15 and 16 allows a locally-installed low-privilege application to exploit missing permission checks in NfcService.java, enabling unauthorized manipulation of NFC payment sessions without any user interaction. The flaw is a missing authorization gate (CWE-862) across multiple functions in the NFC service, permitting a malicious app to hijack, enable, or redirect contactless payment flows targeting the device. No public exploit has been identified and CISA SSVC rates exploitation as none, though the financial-fraud potential elevates practical risk beyond what the EPSS score of 0.11% suggests.

Background activity launch (BAL) restrictions in Android 15, 16, 16-qpr2, and 17 can be bypassed by a locally installed application exploiting a confused deputy pattern spanning multiple framework functions. A low-privileged app manipulates one or more privileged Android system components into launching background activities on its behalf, circumventing protections designed to block unauthorized UI intrusion and enabling local privilege escalation with full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; EPSS at 0.12% (2nd percentile) reflects low observed exploitation activity despite the 7.8 CVSS score.

Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).

Local privilege escalation in Android's AppRestrictionsFragment allows a low-privileged app to gain unauthorized read/write access to private files via a confused deputy in the assertSafeToStartCustomActivity method. Affected versions span Android 14, 15, 16, 16-QPR2, and 17, making this a broad-surface vulnerability across the current Android ecosystem. With PR:L/UI:N, a malicious installed app can silently exploit this without user interaction to achieve full local C:H/I:H/A:H impact. No public exploit identified at time of analysis; EPSS is 0.11% (2nd percentile).

Multi-user isolation breaks in Android's ClipboardService framework layer (CWE-284 Improper Access Control) across Android 14 through 17, enabling a locally-executed low-privileged process to cross user-profile boundaries and escalate privileges with full confidentiality, integrity, and availability impact. The logic error in setClipboardAccessNotificationsEnabledForUser fails to correctly enforce per-user access checks, allowing one user context to manipulate clipboard access notification state for other user profiles on the same device. No public exploit has been identified at time of analysis, and EPSS of 0.12% places this at the 2nd percentile for near-term exploitation probability.

Local privilege escalation in Android's PaymentDefaultDialog allows an attacker with standard app-level execution to silently replace the device's default NFC payment application via a confused deputy in the component's onCreate method. Affecting Android 15, 16, 16-qpr2, and 17, the flaw is patched in the September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, and EPSS sits at 0.11%, consistent with SSVC's 'Exploitation: none' designation despite the high technical impact potential.

Intent redirection bypass in Android's ActivityManagerService enables a low-privileged local app to escalate privileges and gain full device access without any user interaction. The logic error in addCreatorToken of ActivityManagerService.java corrupts the creator-token mechanism that governs Intent origin and authority, allowing a malicious app to redirect Intents to system-protected components that should be inaccessible to it. EPSS at 0.13% (3rd percentile) and no CISA KEV listing indicate limited observed exploitation; no public exploit has been identified at time of analysis.

Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.

Local privilege escalation in Android's Settings app (SettingsFragment.java) affects Android 14 through 17, including 16-qpr2, allowing a low-privileged local attacker to gain full device control via misleading or insufficient UI in the getItemList method. No victim interaction is required - the attacker's own low-privileged app or session is sufficient to trigger the UI bypass. EPSS is 0.12% (2nd percentile) and SSVC records no active exploitation, but SSVC simultaneously rates technical impact as total, reflecting the severity of a successful attack despite limited observed real-world activity.

Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.

Out-of-bounds write in Android's camera metadata validation logic (validate_camera_metadata_structure in camera_metadata.c) allows a local low-privileged attacker to escalate privileges to a higher-privileged context with full confidentiality, integrity, and availability impact. Affects Android 14 through 16-qpr2, patched in the September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; EPSS sits at the 2nd percentile and SSVC rates exploitation as none.

Tapjacking and UI overlay exploitation in Android 16-QPR2's `InstallLaunch.kt` `onCreate` method allows a locally-installed malicious application to present a deceptive interface over the package installation workflow, leading to local privilege escalation with full confidentiality, integrity, and availability impact. Fixed in Google's September 2026 Android Security Bulletin, the flaw requires no additional execution privileges and - per the CVSS vector - no user interaction beyond what occurs during the overlay setup phase. No public exploit code and no active exploitation have been identified at time of analysis; EPSS sits at 0.11% (2nd percentile).

Local privilege escalation in Android 16 and 16-QPR2 allows a low-privileged app to escalate to full device control by exploiting a logic error in HostEmulationManager.java that permits unauthorized background activity launches. The flaw stems from CWE-693 (Protection Mechanism Failure) in the activity-launch gating logic, enabling an installed malicious app to bypass Android's background activity restrictions without requiring additional permissions or user interaction. No public exploit has been identified and CISA has not added this to KEV, but SSVC rates the technical impact as total given that successful exploitation yields C:H/I:H/A:H on the device.