CVE-2026-49918

CVE-2026-49918 is an out-of-bounds write in multiple Android functions caused by an integer overflow, likely when computing buffer sizes or offsets during memory operations. A local attacker who can already execute code in an unprivileged app context can trigger the overflow to write past buffer boundaries and escalate privileges, with no additional execution privileges and no user interaction required. Any Android device on an affected build is exposed, although the available data does not identify the specific component or version range. The flaw was addressed in the September 2026 Android security update; there is no public proof-of-concept, it is not in CISA KEV, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Apply the September 2026 Android security update as soon as your device OEM (Pixel, Samsung, etc.) delivers it, and verify managed fleets report the September 2026 patch level. Because exploitation requires local code execution rather than remote attack, prioritizing patching on devices that run untrusted third-party apps is a reasonable interim risk-reduction step. Watch the AOSP/OEM advisories for the component-level detail needed to scope specific version ranges.