Executive brief
Android devices contain a vulnerability in multiple locations where integer overflow can cause out-of-bounds memory writes. An attacker with basic access to a device can exploit this flaw to gain elevated system privileges and take complete control of the affected Android device, compromising all user data and device functionality.
Technical details
This vulnerability is an integer overflow leading to out-of-bounds write affecting multiple components across Android's runtime and framework layers. The flaw exists in multiple locations within the Android system, allowing an attacker to trigger an integer overflow condition that results in writing data beyond intended memory boundaries. The attack requires only local access with no elevated privileges or user interaction; exploitation leads to local privilege escalation. Patches are available in Android security patch level 2026-09-05 or later, with source code fixes released to the Android Open Source Project (AOSP) repository.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue