CVE-2026-55323

CVE-2026-55323 is an out-of-bounds write (heap buffer overflow) in the gf_base_update_finger_base function of gf_base.c, disclosed through Google's Android vulnerability management program and consistent with the Goodix fingerprint driver used in many Android devices. The flaw is triggered by an app or local code already running on a device with limited privileges, which can corrupt heap memory when the fingerprint component processes data. Successful exploitation yields local escalation of privilege with no additional execution privileges or user interaction required, and high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8). Affected products are Android devices that ship the vulnerable fingerprint component; exact product and version ranges were not provided in the available data, so defenders should treat any unpatched device with this component as potentially affected. No public proof of concept is known and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

What to do: Watch for the fix in Google's monthly Android security bulletin and push affected devices to the latest security patch level; OEMs that ship the gf_base fingerprint component should integrate the patched source in their builds. Because exploitation is local and requires an app already on the device, the primary risk is privilege escalation by mobile malware, so restrict app installation to trusted sources and monitor for apps attempting abnormal access to fingerprint or trusted-execution interfaces.