CVE-2026-45531

An out-of-bounds read caused by a heap buffer overflow exists in the read_boot_region function of fsck.c on Android. It can be triggered when the system's fsck tool processes a malformed or crafted filesystem boot region, with no user interaction and no additional execution privileges required. A successful exploit could allow a local attacker to escalate privileges on the affected device. All Android devices running security patch levels prior to the September 2026 Android Security Update are potentially affected. There is no public proof of concept, the flaw is not in CISA KEV, and EPSS is low (0.1%), indicating no known exploitation to date.

What to do: Apply the September 2026 Android Security Update (or a later OEM patch) and verify the device's security patch level in Settings. Given the low EPSS, absence of a public PoC, and no KEV listing, routine patch cadence is sufficient, but prioritize devices that mount untrusted or removable storage processed by fsck.