Description
In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-09-15
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

Android contains a missing bounds check that can lead to an out‑of‑bounds write. This flaw allows a local attacker to gain system execution privileges, compromising device integrity and confidentiality. The weakness is a classic memory corruption error (CWE‑787).

Affected Systems

The vulnerability impacts devices running Android, specifically those distributed by Google (Pixel devices). No specific OS release or build number is listed in the advisory, but the September 2026 security bulletin applies broadly to Android devices issued by Google at that time.

Risk and Exploitability

The CVSS score of 6.7 indicates a moderate severity for local attackers. The EPSS score of less than 1% suggests that exploitation is rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access and does not need user interaction, so any attacker who can run code on the device can potentially elevate to system level.

Generated by OpenCVE AI on September 20, 2026 at 13:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Android firmware update from Google, as described in the September 2026 security bulletin, to apply the fix for CVE‑2026‑56989.
  • Restrict installation of third‑party applications that request elevated permissions; enforce least‑privilege models whenever possible.
  • Monitor system logs for signs of abnormal privilege‑elevation activity to detect potential exploitation attempts.

Generated by OpenCVE AI on September 20, 2026 at 13:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation via Out-of-Bounds Write on Android

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

Thu, 17 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write Allowing Local Privilege Escalation in Android

Wed, 16 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write Allowing Local Privilege Escalation in Android

Tue, 15 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Tue, 15 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: Google_Devices

Published:

Updated: 2026-09-16T03:58:04.983Z

Reserved: 2026-06-23T16:23:34.033Z

Link: CVE-2026-56989

cve-icon Vulnrichment

Updated: 2026-09-15T21:06:55.632Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T19:17:30.130

Modified: 2026-09-18T17:32:21.787

Link: CVE-2026-56989

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T13:30:17Z

Weaknesses