Junglewise Threat Intelligence

CVE-2026-28639: Android rw_mfc_handle_read_op out-of-bounds write

CVE-2026-28639 · Severity: high · CVSS 7.8 · Published 2026-09-08

Executive brief

An Android system component contains a logic error that allows attackers to write data beyond the bounds of an allocated buffer. An attacker with local access can exploit this flaw to escalate their privileges to a higher level of the system without needing to trick the user or gain elevated permissions beforehand.

Technical details

The vulnerability is an out-of-bounds write (heap or stack buffer overflow) in the rw_mfc_handle_read_op function in rw_mfc.cc, caused by a logic error in buffer boundary checking. The affected code is reachable via local attack vectors with no additional execution privileges required; user interaction is not needed. A local attacker can craft input that triggers the buffer overflow to achieve local privilege escalation. Patches are available in AOSP versions 14, 15, 16, 16-qpr2, and 17 as of the September 2026 security bulletin.

Affected products

  • Google Android 14, 15, 16, 16-qpr2, 17

Timeline

  • 2026-09-08: disclosed: Published in Android Security Bulletin—September 2026
  • 2026-09-01: patched: Patches released for AOSP versions 14, 15, 16, 16-qpr2, 17

References

Related threats