Description
In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-10-05
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability stems from a logic error in several functions within VirtualAudioControllerTest.java that allows a permission bypass. This flaw enables a local attacker to execute privileged operations without needing additional execution rights or user interaction, elevating their capabilities beyond the permissions originally assigned to the process.

Affected Systems

The affected product is Android from Google. No specific release or version is listed, so any Android build that includes the affected VirtualAudioControllerTest.java code may be impacted.

Risk and Exploitability

The flaw is local; an attacker must already have access to the device. No EPSS score is available and it is not listed in the CISA KEV catalog, indicating no publicly known exploits. The CVSS score of 7.8 classifies it as high severity, underscoring the need for a timely fix.

Generated by OpenCVE AI on October 5, 2026 at 22:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the Android security patch v2026‑10‑01 to correct the logic error in VirtualAudioControllerTest.java.
  • Disable or restrict applications or services that rely on VirtualAudioControllerTest functionality, ensuring they operate with the minimal permissions required.
  • Configure the device or security‑management solution to enforce least‑privilege for local processes that interact with VirtualAudioControllerTest, preventing accidental or malicious privilege escalation.

Generated by OpenCVE AI on October 5, 2026 at 22:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_1:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_2:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:qpr2_beta_3:*:*:*:*:*:*
cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*

Mon, 05 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Permission Bypass Enabling Local Privilege Escalation in Android Virtual Audio Controller

Mon, 05 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Title Permission Bypass Enabling Local Privilege Escalation in Android Virtual Audio Controller

Mon, 05 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Mon, 05 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: google_android

Published:

Updated: 2026-10-06T03:55:59.753Z

Reserved: 2026-07-02T05:58:50.042Z

Link: CVE-2026-58841

cve-icon Vulnrichment

Updated: 2026-10-05T19:06:53.660Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-05T19:17:24.753

Modified: 2026-10-07T15:13:02.650

Link: CVE-2026-58841

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-05T22:15:16Z

Weaknesses
  • CWE-269

    Improper Privilege Management