Google Android: Local privilege escalation via out-of-bounds read
Summary
A flaw in several functions of MessageQueueBase.h, caused by an incorrect bounds check, allows an out-of-bounds read on Android devices. A local attacker with low privileges, such as a malicious or compromised app, could escalate privileges on the device. No user interaction is required once the attacker has a foothold on the device. The device is not directly exposed to the internet, but the risk applies to company and BYOD phones and tablets.
Affected
- Android 14
- Android 15
- Android 16
- Android 16-qpr2
- Android 17
Fixed in
- Security patch level 2026-10-01 or later
- No specific fixed AOSP build number published for this CVE.
Workaround
- Unknown. No vendor workaround documented.
- Reduce local risk by limiting sideloaded or unknown apps and enforcing updates via MDM.
Exploitation
- Not known to be exploited in the wild. Google has not indicated active exploitation.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found in searches.
Our recommendation
- Inventory Android devices and their security patch levels.
- Update all supported devices to security patch level 2026-10-01 or later, prioritising devices with work data.
- Enforce updates and restrict sideloading via MDM.
- Re-check NVD and the CISA KEV catalogue for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin October 2026 source.android.com
- Canadian Cyber Centre alert AV26-1003 www.cyber.gc.ca
- CISA ADP Vulnrichment record for CVE-2026-49937 hol.org
- Android October 2026 patch level overview scout.appaloosa.io
- Hexnode threat watch: Android October 2026 security update www.hexnode.com
- Vulners PT-2026-106150 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 06:29.
Original description (NVD)
In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.