CVE-2026-55280

Published: Oct 5, 2026Modified: Oct 7, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected (5)

Products: Google: Android

Google

1 product

Android

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 16.0
Google Android	Version 16.0 qpr2_beta_1
Google Android	Version 16.0 qpr2_beta_2
Google Android	Version 16.0 qpr2_beta_3
Google Android	Version 17.0

Related CWEs

CWE-457

Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

References (1)

https://source.android.com/docs/security/bulletin/2026/2026-10-01

Source: security@android.com

PatchVendor Advisory

Timeline

No history available yet.