CVE-2026-49881

highpriority · track · 10EPSS 0.001 · 1 %ileexploit · PoCDEUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

4 exploits · PoC

Likely / severe?

0.10% (1st) EPSS

CVSS 7.8 · high

Is it mine?

4 products

Check your exposure

Who says so?

3 sources

osv · cert_bund · nvd

EPSS · scored 2026-10-27

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.8 · impact 5.9

v3.17.4highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-693US

exploits (4)

Public proof-of-concept and weaponised exploit code.

LSPosed/LSPromiseAndroid complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel, combination of CVE-2026-49881 and CVE-2026-43284PoC · poc_in_github
Lewason/mhl-off-hook-writeupa challenge for a CVE-2026-49881PoC · poc_in_github
Supersonic/TLPECVE-2026-49881, using insecure context creation in Android 17's Telecom service to execute arbitrary code as UID 1000 system_server from an unprivileged appPoC · poc_in_github
cyb3r-w0lf/CVE-2026-49881cyb3r-w0lf/CVE-2026-49881PoC · poc_in_github

affected products (4)

Products and version ranges known to be affected.

Dell Computerall versionscert_bundDEcpe:/o:dell:dell_computer:-
Google Android <2026-09-01all versionscert_bundDE
Google Android< 2026-09-01cert_bundDE
google android= 17.0nvdUScpe:2.3:o:google:android:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3251Android Patchday September 2026: Mehrere SchwachstellenDeutsch2026-09-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.
ASB-A-5011552442026-09-01vendor · osvUS
In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

also known as (1)

Other names and identifiers for this entity.

A-501155244osv

sources

Which sources assert this record, and when.

osv cert_bund nvd NVD CVE.org MITRE

published 2026-09-08modified 2026-09-23

references (1) nvd

External citations — patches, advisories, analysis.

https://source.android.com/docs/security/bulletin/2026/2026-09-01Vendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan