Executive brief
Android's System component, a core operating system service on all Android devices, contains a heap buffer overflow vulnerability that allows attackers to execute arbitrary code remotely without requiring user interaction or special permissions. Exploitation could give attackers complete control over affected devices, potentially exposing all user data, messages, photos, and installed apps.
Technical details
The vulnerability is a heap buffer overflow in multiple locations within Android's System component. The defect allows remote code execution (RCE) with no additional execution privileges needed and does not require user interaction for exploitation. The attack vector is network-based, and the flaw can be triggered through normal device operation or network communication. Patches have been released and are available in Android Security Patch Level 2026-09-05 and later, with fixes backported to AOSP versions 14, 15, 16, 16-qpr2, and 17.
Affected products
- Google Android 14 through 17
Timeline
- 2026-09-08: disclosed: Android Security Bulletin published
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses the vulnerability