Executive brief
A video processing unit (VPU) driver component in Google Pixel devices contains a buffer overflow vulnerability that allows a local attacker to write data beyond allocated memory boundaries. An attacker with local access to the device can exploit this missing bounds check to escalate privileges to a higher level without needing special permissions or user interaction.
Technical details
The vulnerability is an out-of-bounds write flaw in the Wave6VpuDecFlush function within wave6.c, a VPU codec driver component. The root cause is a missing bounds check that fails to validate memory write operations. This allows a local attacker to overwrite adjacent memory regions, potentially corrupting critical data structures or executing arbitrary code with elevated privileges. The attack requires local code execution capability (local attack vector) but no user interaction or special permissions. Google has patched this vulnerability with the 2026-09-05 security patch level for Pixel devices.
Affected products
- Google Pixel 2026-09-05 and later
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later