Out-of-Bounds Write in Android openLogicalChannel Enables Local Privilege Escalation
AI analysis
CVE-2026-55285 is an out-of-bounds write (CWE-120) in the openLogicalChannel routine of multiple files in the Android OS, caused by a missing bounds check. A local attacker needs no additional execution privileges and no user interaction to trigger the flaw, which corrupts memory and enables local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/PR:L/UI:N). Any Android device carrying the affected platform code is exposed, though Google has not published affected version ranges in the available data; fixes ship in the September 2026 Android Security Bulletin. Exploitation status: no public proof-of-concept, not listed in CISA KEV, and EPSS assigns a 0.1% probability of exploitation in the next 30 days, so no confirmed in-the-wild exploitation is known. The related September 2026 bulletin headline covers broader Android fixes including RCE bugs, but this specific flaw is a local privilege escalation, not a remote one.
What to do: Apply the September 2026 Android Security Bulletin as delivered by Google and OEMs (e.g., Samsung and other vendor monthly patch releases), and verify each device's Android security patch level is September 2026 or later via Settings > About phone > Android security update. Until patched, restrict untrusted local apps and device access, since exploitation requires only local code execution with no user interaction or special privileges. Monitor the Android security bulletin for published affected-version ranges, which are not yet enumerated in the available data.
Affected
| Google Android OS (openLogicalChannel routine, multiple files) | — |
Estimated exposure
mass~3 billion+ Android devices potentially affected (exact vulnerable-version scope unpublished) — Android runs on roughly 3 billion or more active devices globally and this is a platform-level flaw fixed in the monthly Android bulletin, so the realistic order of magnitude approaches the full Android install base; no published version…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.