CVE-2026-56978

CVE-2026-56978 is a missing bounds check in the get_global_config_item_addr function of gc.c, disclosed through Google's Android CNA ([email protected]) in Android security-bulletin style. A local attacker who can already execute code on the device with no special privileges can trigger a read past the end of a buffer (CWE-125/CWE-120), and no user interaction is required. Successful exploitation yields local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Any Android device running a build containing the vulnerable code is potentially affected; the record does not specify version ranges, so defenders should consult the corresponding Google Android security bulletin for patch levels. No exploitation is currently known: the flaw is not in CISA KEV and no public proof-of-concept exists.

What to do: Apply the Android security patch level that addresses CVE-2026-56978 as published in Google's monthly Android security bulletin (verify via Settings > Security > security patch level and install available OTA updates). Because exploitation requires local code execution at low privilege, prioritize patching and restrict untrusted app installs on high-risk devices until updated. No public PoC, KEV listing, or workaround is currently available.