Executive brief
Android's camera system contains a logical error in how it validates camera metadata structures, allowing a local attacker to write data outside allocated memory boundaries. This can lead to privilege escalation and enable an attacker to gain system-level access to the device without needing user interaction or special permissions.
Technical details
The vulnerability is an out-of-bounds write in the validate_camera_metadata_structure function of camera_metadata.c, caused by a logical error in bounds checking. The flaw allows local code execution with no additional privileges needed, and exploitation requires no user interaction. This memory corruption can be leveraged for local privilege escalation (EoP). Patches have been released to AOSP and are available in Android 14, 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level of 2026-09-05 or later addresses this issue