{"id":"CVE-2026-70386","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-70386","generatedAt":"2026-10-28T10:37:30.305Z","title":"Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android.","description":"Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared \nand no user interaction beyond launching it, can execute arbitrary shell\n commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects \ncombine: (a) OnePlus's atlasservice binder interface accepts \nsetEvent(String8 name, String8 value) from any caller without \nauthorization, and (b) one event handler \n(OplusAtlasLogWriter::handleEvent, matching event name \natlas_event_multimedia_audio_dumpsys) copies the caller-supplied value \ninto the system property oplus.audio.dumpinfo.type and starts the root \ninit service audiodumpinfo, which passes that property value unsanitized\n to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.","published":"2026-10-21T09:17:08.000Z","lastModified":"2026-10-22T16:58:52.000Z","status":"Deferred","sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","cvss":{"version":"4.0","score":8.5,"severity":"HIGH","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-78","CWE-862"],"affected":[],"epss":{"score":0.01221,"percentile":0.68543,"date":"2026-10-27","history":[{"date":"2026-10-21","score":0.01221,"percentile":0.68438}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T09:17:08.000Z","detail":{"score":"8.5","severity":"HIGH","publishedAt":"2026-10-21T09:17:07.787Z"},"summary":"New CVE, high severity (CVSS 8.5)."}],"references":[{"url":"https://blog.nns.ee/2026/09/24/oneplus-root/","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-70386","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}