Executive brief
An Android system component contains a logic error that allows attackers to write data beyond the bounds of an allocated buffer. An attacker with local access can exploit this flaw to escalate their privileges to a higher level of the system without needing to trick the user or gain elevated permissions beforehand.
Technical details
The vulnerability is an out-of-bounds write (heap or stack buffer overflow) in the rw_mfc_handle_read_op function in rw_mfc.cc, caused by a logic error in buffer boundary checking. The affected code is reachable via local attack vectors with no additional execution privileges required; user interaction is not needed. A local attacker can craft input that triggers the buffer overflow to achieve local privilege escalation. Patches are available in AOSP versions 14, 15, 16, 16-qpr2, and 17 as of the September 2026 security bulletin.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin—September 2026
- 2026-09-01: patched: Patches released for AOSP versions 14, 15, 16, 16-qpr2, 17