CVE-2026-55277

CVE-2026-55277 is a missing-bounds-check flaw in the checkUiccListenConfigNeeded function of RoutingManager.cpp in the Android operating system, resulting in an out-of-bounds write (CWE-120). It can be triggered remotely over a proximal/adjacent connection (CVSS attack vector 'adjacent', e.g., within radio or local-network reach) and requires no user interaction and no additional execution privileges. A successful attacker gains code execution in the affected component with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.0, High). Any Android device running a build that predates the September 2026 Android security update and containing the vulnerable code is potentially affected; the fix is delivered in the September 2026 Android Security Update. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days (2nd percentile).

What to do: Install the September 2026 (or later) Android security update on affected devices, either via Settings > System > System update or through OEM/carrier rollout, and verify the patch level on managed fleets with MDM tooling. No public proof-of-concept or known exploitation exists yet, so there is no urgent workaround, but prioritize patching because the flaw allows unprivileged, no-interaction remote code execution over an adjacent network path.