Executive brief
Android's core system framework contains a memory safety vulnerability caused by an integer overflow that can allow a local attacker to gain elevated privileges on the device. No special permissions or user interaction are required, making this a significant risk for any Android device that hasn't received the latest security patch.
Technical details
The vulnerability is an integer overflow memory safety issue affecting multiple locations in the Android Framework component. The flaw allows for local escalation of privilege (EoP) with no additional execution privileges required—an unprivileged app or process can exploit this to gain higher system access. The attack vector is local, and user interaction is not needed for exploitation. Patches are available in Android security patch level 2026-09-05 or later, with source code fixes released to AOSP for Android versions 14 through 17.
Affected products
- Google Android 14, 15, 16, 17
Timeline
- 2026-09-08: disclosed
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue