OnePlus OxygenOS: Local privilege escalation to root via AtlasService and vendor HAL
Summary
A locally installed Android app without any declared permissions can run shell commands as root (uid 0) on affected OnePlus and OPPO devices. The attack chains an unauthenticated AtlasService binder call with command injection in the audioDumpInfo service, and a vendor HAL (olc2) that runs shell commands for any uid 0 caller. The attacker needs a malicious app installed on the device and only has to launch it.
Affected
- OxygenOS from 16.1.0 before 16.1.10.500
- OxygenOS from 16.0.0 before 16.0.5.1200
- OxygenOS from 15.0.0 before 15.0.0.2000
- Full list of affected OnePlus and OPPO models: unknown; OnePlus has not published it yet.
Fixed in
- Fixed builds per CVE record thresholds: 16.1.10.500, 16.0.5.1200, 15.0.0.2000 (or later).
- The researcher reports that OxygenOS 16.0.10.500(EX01) fixes the issues on the OnePlus 15. This does not match the 16.1 threshold, so verify the fixed build for each branch.
- OnePlus reported 151 maintained devices patched and 18 pending release (as of 28 September 2026).
- Official OnePlus security bulletin: not located.
Workaround
- No workaround replaces the patch.
- Restrict installation of unapproved apps and avoid sideloading.
- Check devices for root indicators.
- An MDM cannot repair the vulnerable vendor service.
Exploitation
- Public proof of concept and write-up are available (researcher blog, 24 September 2026).
- CISA SSVC: exploitation status PoC, not automatable.
- Not listed in CISA KEV. EPSS about 1.2% at the time of the data.
- No evidence of exploitation in the wild at disclosure.
Our recommendation
- Identify all OnePlus and OPPO phones in use, including BYOD devices with company data access.
- Update OxygenOS to the newest build for your model and verify the build number against OnePlus's security bulletin.
- Allow only approved apps from the Play Store and block sideloading via MDM.
- Monitor devices for unknown apps and root indicators, and treat devices with suspected compromise as untrusted.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Researcher write-up (nns.ee) blog.nns.ee
- OpenCVE CVE-2026-70386 app.opencve.io
- Hexnode threat watch: OxygenOS unpatched root flaws www.hexnode.com
- GSMGoTech: OxygenOS root exploit www.gsmgotech.com
- TechJournal: OnePlus root flaw patches techjournal.org
- OnePlus community thread community.oneplus.com
- Tech Insider: OnePlus root vulnerability tech-insider.org
- CVE threatint record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:16.
Original description (NVD)
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.