CVE-2026-0199

CVE-2026-0199 is an out-of-bounds write (CWE-787) caused by improper input validation (CWE-20) in the gf_ta_test_set_config function of gf_ta_test.c, part of a trusted application ('gf_ta', consistent with a fingerprint TEE component) running on Android devices. A malicious app already present on the device with only ordinary low-level privileges can invoke this configuration path and write past a buffer boundary, with no user interaction and no additional execution privileges required. Successful exploitation yields local escalation of privilege with high impact on confidentiality, integrity, and availability — potentially allowing an app to escape its sandbox into a higher-privilege device context — reflected in a CVSS 3.1 base score of 7.8. Android handsets that ship the affected trusted application are impacted; exact vendor and version ranges were not specified in the advisory, with fixes delivered through Google/OEM security updates. There is no known public proof of concept, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Apply the Android security update / OEM OTA that patches the gf_ta trusted application and verify each device's security patch level against the relevant monthly Android Security Bulletin. Because exploitation requires only a locally installed app, block sideloading of untrusted applications and monitor fleets for apps that unusually access TEE or hardware-backed services. Confirm fix availability with the device vendor, as TEE firmware patches may lag behind standard AOSP updates.