AI analysis
CVE-2026-55277 is a missing-bounds-check flaw in the checkUiccListenConfigNeeded function of RoutingManager.cpp in the Android operating system, resulting in an out-of-bounds write (CWE-120). It can be triggered remotely over a proximal/adjacent connection (CVSS attack vector 'adjacent', e.g., within radio or local-network reach) and requires no user interaction and no additional execution privileges. A successful attacker gains code execution in the affected component with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.0, High). Any Android device running a build that predates the September 2026 Android security update and containing the vulnerable code is potentially affected; the fix is delivered in the September 2026 Android Security Update. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only about a 0.1% probability of exploitation in the next 30 days (2nd percentile).
What to do: Install the September 2026 (or later) Android security update on affected devices, either via Settings > System > System update or through OEM/carrier rollout, and verify the patch level on managed fleets with MDM tooling. No public proof-of-concept or known exploitation exists yet, so there is no urgent workaround, but prioritize patching because the flaw allows unprivileged, no-interaction remote code execution over an adjacent network path.
Affected
| Google (Android) Android (RoutingManager.cpp, checkUiccListenConfigNeeded) | — |
Estimated exposure
masson the order of billions of Android devices potentially affected (Android runs on 3+ billion active devices worldwide) — The vulnerable code is in the Android platform (CNA [email protected]), so the upper bound is Android's global installed base of billions of devices, limited in practice to unpatched builds that include the vulnerable component; the… Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.