OnePlus OxygenOS allows any locally installed Android application, even if it declares no permissions and without user interaction beyond launch, to execute arbitrary shell commands as uid 0 within the u:r:dumpstate:s0 SELinux domain. The vulnerability results from two defects: an unsecured binder interface that accepts setEvent(String8 name, String8 value) calls from any caller without authorization, and an event handler that copies the caller‑supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo. The unsanitized property value is then passed to system(), enabling it to run any command with root privileges. This combination permits a local attacker to achieve full system compromise.

The affected products are OnePlus OxygenOS operating systems. Vulnerable versions include all releases from OxygenOS 16.1.0 prior to 16.1.10.500, from OxygenOS 16.0.0 prior to 16.0.5.1200, and from OxygenOS 15.0.0 prior to 15.0.0.2000.

The CVSS score of 8.5 indicates a high severity vulnerability. The EPSS score of 1% reflects a moderate exploit probability, and the issue is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Attackers need only a local application; no remote network access or elevated permissions are required beyond exploiting the faulted interface. Once the vulnerability is triggered, the attacker can execute any shell command as root, producing complete control over the device.