Executive brief
Android devices contain a logic error in the runtime image writing component (WriteImageToDisk in runtime_image.cc) that allows local attackers to tamper with files on the device. An attacker with local access can exploit this flaw to gain elevated privileges without requiring special permissions or user interaction, potentially compromising the integrity of system files and gaining control over the device.
Technical details
CVE-2026-28664 is a local privilege escalation (EoP) vulnerability in the Android Runtime component, specifically in the WriteImageToDisk function within runtime_image.cc. The vulnerability stems from a logic error in the code that fails to properly validate or protect file operations during image writing. An attacker with local code execution can exploit this flaw to tamper with files without requiring additional execution privileges or user interaction. The vulnerability affects Android 14 through Android 17, with patches available in the 2026-09-05 security patch level and later. The vulnerability enables local escalation of privilege with no additional execution privileges needed.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Published in Android Security Bulletin
- 2026-09-05: patched: Security patch level 2026-09-05 and later address this issue