Local Privilege Escalation via Heap Overflow in Android fsck
An out-of-bounds read caused by a heap buffer overflow exists in the read_boot_region function of fsck.c on Android. It can be triggered when the system's fsck tool processes a malformed or crafted filesystem boot region, with no user interaction and no additional execution privileges required. A successful exploit could allow a local attacker to escalate privileges on the affected device. All Android devices running security patch levels prior to the September 2026 Android Security Update are potentially affected. There is no public proof of concept, the flaw is not in CISA KEV, and EPSS is low (0.1%), indicating no known exploitation to date.
What to do: Apply the September 2026 Android Security Update (or a later OEM patch) and verify the device's security patch level in Settings. Given the low EPSS, absence of a public PoC, and no KEV listing, routine patch cadence is sufficient, but prioritize devices that mount untrusted or removable storage processed by fsck.
| Product | Affected |
|---|---|
| Google (Android) Android (fsck component, read_boot_region in fsck.c) | Android devices on security patch levels before the September 2026 Android Security Update; fixed in the September 2026 update (specific affected version ranges |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Google's September 2026 Android bulletin fixes over 30 critical flaws, including no-interaction system RCEs, a TIPC kernel RCE and a Qualcomm closed-source bug
Today 665 readers · 812 views · 613 reads · all time 158K views