The vulnerability arises from an exposed binder method in the OxygenOS logging HAL that executes a shell command supplied by the caller. The only check is that the caller has UID zero, and SELinux grants access to that HAL to a broad set of client domains. An attacker who can become a uid‑0 process in any of those domains, such as a dumpstate process, can trigger the method to execute arbitrary commands. This grants full system compromise, as the spawned shell runs in the vendor_qti_init_shell context with all Linux capabilities. The weakness aligns with CWE‑749 and CWE‑863.

The flaw affects OnePlus OxygenOS versions 15.0.0.0‑15.0.0.1999, 16.0.0.0‑16.0.5.1199, and 16.1.0.0‑16.1.10.499. Users on any of these builds can be impacted if the binder method is reachable.

The CVSS score of 8.4 points to high severity, but the EPSS score of less than 1% suggests that exploitation in the wild is currently unlikely. The vulnerability is not listed in the CISA KEV catalogue. An attacker would need to obtain uid‑0 access in one of the permitted SELinux domains, a goal that can be achieved through other local privilege escalation bugs. Once achieved, the binder call provides a clean path to command execution without needing external input. The path requires local interaction with the Android system services, not remote network connections, indicating the attack vector is local.