Executive brief
Android's memory allocation library contains a use-after-free vulnerability in the LimitRealloc function that allows local attackers to escalate privileges without requiring special permissions or user interaction. This could enable an attacker with basic app installation capability to gain elevated system access.
Technical details
The vulnerability is a use-after-free defect in the LimitRealloc function of malloc_limit.cpp, resulting from a logic error in memory reallocation handling. The flaw allows local code execution with no additional privileges required and no user interaction needed for exploitation. An attacker can achieve local privilege escalation by triggering the vulnerable code path through normal app functionality. Patches are available in Android 14 and later through the 2026-09-05 security patch level.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched