Executive brief
Android's runtime environment contains a memory safety bug in the rw_mfc_handle_read_op function that allows an attacker to write data beyond allocated buffer boundaries. An attacker with local access to a device can exploit this flaw to escalate their privileges and gain unauthorized control over the system without needing any special permissions or user interaction.
Technical details
The vulnerability is a classic out-of-bounds write (OOB write) caused by an incorrect bounds check in the rw_mfc_handle_read_op function within rw_mfc.cc in Android's runtime component. The flaw allows an attacker to write data past the end of an allocated buffer, potentially corrupting adjacent memory structures. This is a local privilege escalation vulnerability accessible to unprivileged local processes with no additional execution privileges required and no user interaction needed. Patches are available in Android 14 and later versions (14, 15, 16, 16-qpr2, 17 per the AOSP bulletin).
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched