Google Android: Out-of-bounds write due to uninitialized data
Summary
An out-of-bounds write caused by uninitialized data exists in multiple locations of Android's System component. According to the CVE record and CVSS (8.8), an attacker with low privileges could escalate privileges remotely without user interaction, which could lead to a complete compromise of confidentiality, integrity and availability. The Android Security Bulletin describes the issue as a local escalation of privilege, which conflicts with the CVE record; until Google clarifies, the network scenario should be assumed.
Affected
- Android 16, 16-qpr2 and 17 (AOSP versions listed in the Android Security Bulletin, October 2026)
- The official CVE record lists Android 17 and 16-qpr2 as affected and Android 16 as unaffected by default; the bulletin lists Android 16 as affected, so the bulletin is followed here.
- Device vendors (for example Samsung) ship fixes on their own schedules.
Fixed in
- Security patch level 2026-10-01 or later (per the Android Security Bulletin, October 2026)
- Exact build numbers: Unknown.
Workaround
Unknown. No vendor-documented workaround was found; patching is the only verified remediation.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total
- Not listed in the CISA KEV catalogue (per research notes)
- No public proof of concept found in searches; this does not prove that none exists
Our recommendation
- Verify that all Android 16 and 17 devices report security patch level 2026-10-01 or later.
- Enforce the patch level through mobile device management (MDM), including company and BYOD devices.
- Confirm that OEM builds (for example Samsung) include the fix.
- Monitor the Android Security Bulletin and CISA for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Android Security Bulletin, October 2026 source.android.com
- OpenCVE record CVE-2026-55280 app.opencve.io
- TechRepublic on Samsung's October 2026 update www.techrepublic.com
- Samsung October 2026 security patch release notes www.sammyfans.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:31.
Original description (NVD)
In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.