Executive brief
An out-of-bounds write vulnerability exists in Android's openLogicalChannel code due to a missing bounds check. An unprivileged local attacker can exploit this to escalate their privileges on an Android device. No user interaction or special permissions are required for exploitation.
Technical details
The vulnerability is an out-of-bounds write in openLogicalChannel of multiple Android framework files caused by missing bounds validation. A local attacker without elevated privileges can trigger this memory corruption to escalate to higher privilege levels. The Android security patch level 2026-09-05 or later addresses this issue across Android versions 14 through 17.
Affected products
- Google Android 14, 15, 16, 16-qpr2, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched