Description
In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-09-15
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

Android contains a missing bounds check that can lead to an out‑of‑bounds write. This flaw allows a local attacker to gain system execution privileges, compromising device integrity and confidentiality. The weakness is a classic memory corruption error (CWE‑787).

Affected Systems

The vulnerability impacts devices running Android, specifically those distributed by Google (Pixel devices). No specific OS release or build number is listed in the advisory, but the September 2026 security bulletin applies broadly to Android devices issued by Google at that time.

Risk and Exploitability

The CVSS score of 6.7 indicates a moderate severity for local attackers. The EPSS score of less than 1% suggests that exploitation is rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access and does not need user interaction, so any attacker who can run code on the device can potentially elevate to system level.

Generated by OpenCVE AI on September 17, 2026 at 11:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Android firmware update from Google, as described in the September 2026 security bulletin, to apply the fix for CVE‑2026‑56989.
  • Restrict installation of third‑party applications that request elevated permissions; enforce least‑privilege models whenever possible.
  • Monitor system logs for signs of abnormal privilege‑elevation activity to detect potential exploitation attempts.

Generated by OpenCVE AI on September 17, 2026 at 11:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write Allowing Local Privilege Escalation in Android

Wed, 16 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write Allowing Local Privilege Escalation in Android

Tue, 15 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Tue, 15 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: Google_Devices

Published:

Updated: 2026-09-16T03:58:04.983Z

Reserved: 2026-06-23T16:23:34.033Z

Link: CVE-2026-56989

cve-icon Vulnrichment

Updated: 2026-09-15T21:06:55.632Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T19:17:30.130

Modified: 2026-09-16T19:24:44.153

Link: CVE-2026-56989

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T11:15:07Z

Weaknesses