Executive brief
The Android Framework contains a memory handling vulnerability in its PDU (Protocol Data Unit) parser that could allow a local attacker to read beyond allocated memory boundaries. An attacker with access to the device could exploit this flaw to escalate privileges without needing special permissions or user interaction, potentially compromising the security of the entire device.
Technical details
A heap buffer overflow vulnerability exists in the parseParts method of PduParser.java within the Android Framework, leading to an out-of-bounds read condition. The vulnerability allows local code execution without requiring elevated privileges or user interaction. The flaw affects Android Framework versions 14 through 17, with patches available in the Android Security Bulletin's 2026-09-05 security patch level. This is a denial-of-service/privilege escalation issue that can be triggered by crafted input to the PDU parser component.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed: Android Security Bulletin published
- 2026-09-05: patched: Security patch level 2026-09-05 and later address this issue