cve-2026-49884
HIGH CVSS 7.8 opencve
Description
In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Timeline
- Published
- 2026-09-08 19:17 UTC
- Last Modified
- 2026-09-23
CVSS Details
CVSS details not available.
Affected Products
No product information available.
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
nvd | ||
| 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
opencve | ||
| 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
vulnrichment |
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cve": "CVE-2026-49884",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "17"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "16-qpr2"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "16"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "15"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "generic",
"value": "14"
}
}
],
"enrichment": {
"confidence": 100.0,
"confidence_source": "matching",
"scores": [
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Android",
"source": "cna",
"vendor": "Google"
},
"product": "android",
"vendor": "google"
}
],
"created": "2026-09-09T14:45:05.601694+00:00",
"title": "Out-of-Bounds Write in Android MFC Handling Allows Local Privilege Escalation",
"updated": "2026-09-11T02:15:10.960020+00:00",
"vendors": [
"google",
"google$PRODUCT$android"
]
},
"epss": {
"score": 0.00079
},
"mitre": {
"cpes": [],
"created": "2026-09-08T18:05:45.747000+00:00",
"description": "In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/49xxx/CVE-2026-49884.json",
"references": [
"https://source.android.com/docs/security/bulletin/2026/2026-09-01"
],
"title": null,
"updated": "2026-09-10T13:35:33.331000+00:00",
"vendors": [],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*",
"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*",
"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*"
],
"created": "2026-09-08T19:17:58.660000+00:00",
"description": "In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 7.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-49884.json",
"references": [
"https://source.android.com/docs/security/bulletin/2026/2026-09-01"
],
"title": null,
"updated": "2026-09-23T19:20:37.657000+00:00",
"vendors": [
"google",
"google$PRODUCT$android"
],
"weaknesses": [
"CWE-120"
]
},
"opencve": {
"changes": [
{
"created": "2026-09-08T18:30:00+00:00",
"data": [
{
"details": {
"new": "In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"old": null
},
"type": "description"
},
{
"details": {
"added": [
"https://source.android.com/docs/security/bulletin/2026/2026-09-01"
],
"removed": []
},
"type": "references"
}
],
"id": "c5c3f72a-f973-49a2-b811-1acd5a01daf2"
},
{
"created": "2026-09-09T15:00:00+00:00",
"data": [
{
"details": {
"new": "Android Local Privilege Escalation via Out‑of‑Bounds Write in MFC Handle Read Operation",
"old": null
},
"type": "title"
},
{
"details": {
"added": [
"CWE-123",
"CWE-787"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "d3023378-686c-42cc-be74-ed87cc170b63"
},
{
"created": "2026-09-10T09:30:00+00:00",
"data": [
{
"details": [
"google",
"google$PRODUCT$android"
],
"type": "first_time"
},
{
"details": {
"added": [
"google",
"google$PRODUCT$android"
],
"removed": []
},
"type": "vendors"
}
],
"id": "00625f7a-514e-40d0-b0e8-28b8af9942ba"
},
{
"created": "2026-09-10T14:30:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-120"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": {
"cvssV3_1": {
"score": 7.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "efd936a6-ee16-4cc1-80d0-7705fbf0dabd"
},
{
"created": "2026-09-10T16:45:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Android Local Privilege Escalation via Out‑of‑Bounds Write in MFC Handle Read Operation"
},
"type": "title"
},
{
"details": {
"added": [],
"removed": [
"CWE-123",
"CWE-787"
]
},
"type": "weaknesses"
}
],
"id": "2263c5f7-0715-46aa-b61e-90773d0028fb"
},
{
"created": "2026-09-10T19:45:00+00:00",
"data": [
{
"details": {
"new": "Out-of-Bounds Write in Android's MFC Handler Allows Local Privilege Escalation",
"old": null
},
"type": "title"
}
],
"id": "934f0e64-b589-4894-b5d7-64d13d9d83b6"
},
{
"created": "2026-09-10T22:15:00+00:00",
"data": [
{
"details": {
"new": null,
"old": "Out-of-Bounds Write in Android's MFC Handler Allows Local Privilege Escalation"
},
"type": "title"
}
],
"id": "7f44f691-fe28-46fb-a55a-1ecf042460ee"
},
{
"created": "2026-09-11T02:30:00+00:00",
"data": [
{
"details": {
"new": "Out-of-Bounds Write in Android MFC Handling Allows Local Privilege Escalation",
"old": null
},
"type": "title"
}
],
"id": "6171c990-e1f5-4a9c-9c51-f7bc443e57a5"
},
{
"created": "2026-09-23T19:30:00+00:00",
"data": [
{
"details": {
"added": [
"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*",
"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*",
"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
}
],
"id": "77f130bd-a7b5-412f-be0d-b062e454fbe5"
}
],
"cpes": {
"data": [
"cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
"cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*",
"cpe:2.3:o:google:android:16.0:qpr2:*:*:*:*:*:*",
"cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*"
],
"providers": [
"nvd"
]
},
"created": {
"data": "2026-09-08T18:05:45.747000+00:00",
"provider": "mitre"
},
"description": {
"data": "In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 7.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"provider": "vulnrichment"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00079
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
},
"provider": "vulnrichment"
},
"threat_severity": {
"data": null,
"provider": null
}
},
"references": {
"data": [
"https://source.android.com/docs/security/bulletin/2026/2026-09-01"
],
"providers": [
"mitre",
"nvd"
]
},
"title": {
"data": "Out-of-Bounds Write in Android MFC Handling Allows Local Privilege Escalation",
"provider": "enrichment"
},
"updated": {
"data": "2026-09-23T19:20:37.657000+00:00",
"provider": "nvd"
},
"vendors": {
"data": [
"google",
"google$PRODUCT$android"
],
"providers": [
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-120"
],
"providers": [
"nvd",
"vulnrichment"
]
}
},
"vulnrichment": {
"cpes": [],
"created": "2026-09-08T18:05:45.747000+00:00",
"description": "In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 7.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {},
"kev": {},
"ssvc": {
"options": {
"Automatable": "no",
"Exploitation": "none",
"Technical Impact": "total"
},
"version": "2.0.3"
}
},
"references": [],
"title": null,
"updated": "2026-09-10T13:35:30.393000+00:00",
"vendors": [],
"vulnrichment_repo_path": "2026/49xxx/CVE-2026-49884.json",
"weaknesses": [
"CWE-120"
]
}
}
Enrichment data
Aggregated bundle (all enrichments)