ZeroHour

CVE-2026-55277

mass

Out-of-Bounds Write in Android UICC RoutingManager Enables Adjacent-Network RCE

CVSS 3.1
8.0 high
EPSS
<1%p2
Published
()
Modified
AI analysis

CVE-2026-55277 is a missing-bounds-check flaw in the checkUiccListenConfigNeeded function of RoutingManager.cpp in the Android operating system, resulting in an out-of-bounds write (CWE-120). It can be triggered remotely over a proximal/adjacent connection (CVSS attack vector 'adjacent', e.g., within radio or local-network reach) and requires no user interaction and no additional execution privileges. A successful attacker gains code execution in the affected component with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.0, High). Any Android device running a build that predates the September 2026 Android security update and containing the vulnerable code is potentially affected; the fix is delivered in the September 2026 Android Security Update. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days (2nd percentile).

What to do: Install the September 2026 (or later) Android security update on affected devices, either via Settings > System > System update or through OEM/carrier rollout, and verify the patch level on managed fleets with MDM tooling. No public proof-of-concept or known exploitation exists yet, so there is no urgent workaround, but prioritize patching because the flaw allows unprivileged, no-interaction remote code execution over an adjacent network path.

Affected
Google (Android) Android (RoutingManager.cpp, checkUiccListenConfigNeeded)
Estimated exposure
masson the order of billions of Android devices potentially affected (Android runs on 3+ billion active devices worldwide) — The vulnerable code is in the Android platform (CNA [email protected]), so the upper bound is Android's global installed base of billions of devices, limited in practice to unpatched builds that include the vulnerable component; the…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Weakness
CWE-120
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the news

Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks

Google's September 2026 Android bulletin fixes over 30 critical flaws, including no-interaction system RCEs, a TIPC kernel RCE and a Qualcomm closed-source bug

Google's Android Security Bulletin for September 2026 (patch levels 2026-09-01 and 2026-09-05) fixes numerous critical System remote code execution flaws, including CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919 and CVE-2026-49921, none requiring user interaction or additional privileges. It also addresses critical kernel issues including a TIPC RCE (CVE-2026-52993) and elevation-of-privilege flaws in NFC and protected KVM, plus a critical Qualcomm closed-source component flaw (CVE-2026-25289). Affected versions span Android 14 through 17; the 2026-09-05 patch level extends coverage to Android TV and chipset components, with high-severity fixes for Arm Mali, PowerVR, MediaTek, Unisoc and Qualcomm components.