Description
In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-09-15
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds write in several functions of remap.c caused by an incorrect bounds check. This flaw can allow an attacker to overwrite memory locations on the device, potentially granting local System execution privileges. No user interaction is required for exploitation, meaning an attacker who can run code locally on the device can abuse the issue to elevate privileges.

Affected Systems

The affected products are Google Android devices. No specific Android versions are listed in the advisory, but any device that has not yet applied the latest security update referenced by the Google bulletin would be vulnerable.

Risk and Exploitability

With a CVSS score of 6.7, the vulnerability is moderate in severity. The EPSS score of 0.00075 (well below 1%) indicates a very low probability of exploitation, and it is not listed in the CISA KEV catalog. No user interaction is required, making the attack convenient for an attacker who has already compromised the device.

Generated by OpenCVE AI on September 17, 2026 at 09:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Android security update that fixes the out‑of‑bounds write in services and applications to reduce the impact of a potential escalation.
  • Continuously monitor the device for unauthorized privilege changes and audit logs for signs of privilege abuse.
  • Check for and apply any related corruption vulnerabilities.

Generated by OpenCVE AI on September 17, 2026 at 09:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 10:15:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write in remap.c Leading to Local Privilege Escalation

Wed, 16 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write in remap.c Leading to Local Privilege Escalation

Tue, 15 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Tue, 15 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: Google_Devices

Published:

Updated: 2026-09-16T03:58:09.260Z

Reserved: 2026-06-16T17:55:41.478Z

Link: CVE-2026-55365

cve-icon Vulnrichment

Updated: 2026-09-15T21:11:49.296Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T19:17:22.123

Modified: 2026-09-16T19:24:44.153

Link: CVE-2026-55365

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T10:00:12Z

Weaknesses