{"id":"CVE-2026-55286","published":"2026-10-05T19:17:24.317","lastModified":"2026-10-07T14:22:13.460","description":"In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-119"],"vendors":["google"],"products":["android"],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-10-01","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A buffer overflow vulnerability in Google's Android system allows local attackers to escalate privileges without needing additional execution privileges. The flaw occurs in stpropnci_process due to incorrect bounds checking.","exploitability":"Exploitation is relatively straightforward as it requires only local access with no user interaction needed, making it highly suitable for privilege escalation attacks.","blast_radius":"The vulnerability could affect all Android devices running the affected system components, potentially enabling attackers to gain full system control from a local account.","remediation":"Upgrade to Android 15 or later, as this version contains the necessary fixes for the stpropnci_process buffer overflow issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","local-exploit","android"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:57:06.689Z"}}