CVE-2026-70386: OnePlus OxygenOS privilege escalation via atlasservice and audio debug service

CVE-2026-70386 · Severity: info · Published 2026-10-21

OnePlus OxygenOS contains a privilege escalation vulnerability allowing untrusted Android applications to gain root access without any permissions or user interaction. An attacker can craft a malicious app that exploits two chained defects in the Atlas telemetry service and audio debug daemon to execute arbitrary commands with full system privileges, leading to complete device compromise and data theft.

Technologies: Oneplus Oxygenos. Vendors: Oneplus.

Quick answers

Is CVE-2026-70386 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-70386 being exploited in the wild.
How severe is CVE-2026-70386?
Informational severity, published 21 October 2026.
Which products and versions are affected?
Oneplus Oxygenos 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000.
Is there a fix for CVE-2026-70386?
Yes: fixed in OxygenOS 16.1.10.500, 16.0.5.1200, 15.0.0.2000. Until then: Restrict installation of untrusted applications from outside the Play Store; use Android device administration controls to enforce app review policies until patches are applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70386 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-70386?
Check whether you run Oneplus Oxygenos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: OxygenOS 16.1.10.500, 16.0.5.1200, 15.0.0.2000

Restrict installation of untrusted applications from outside the Play Store; use Android device administration controls to enforce app review policies until patches are applied.

Technical details

A local privilege escalation combining two vulnerabilities: (1) the atlasservice binder interface lacks authorization checks on the setEvent() method, allowing any app to set arbitrary event properties; (2) the audiodumpinfo service unsanitized the attacker-supplied oplus.audio.dumpinfo.type system property before passing it to system(), enabling OS command injection. An untrusted app with no declared permissions can chain these to execute shell commands as uid 0 in the dumpstate SELinux domain, then escalate further via the vendor olc2 HAL's doShell() method.

Affected products

  • OnePlus OxygenOS 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000

Timeline

  • 2026-09-24: disclosed: Security research published detailing the vulnerability chain
  • 2026-10-21: advisory: CVE-2026-70386 advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.