OnePlus OxygenOS: Command execution via olc2 logging HAL
Summary
OnePlus OxygenOS on Android contains an authorization flaw in the olc2 logging vendor HAL. Its doShell binder method forks a shell and runs a caller-supplied command, and the only check is that the caller has uid 0. A local attacker who already runs code as uid 0 in an allowed SELinux domain (for example via dumpstate) can execute arbitrary commands with all Linux capabilities. The CVE record is a second-stage escalation, and the published chain starts from a plain installed app.
Affected
- OxygenOS 16.1.0 before 16.1.10.500
- OxygenOS 16.0.0 before 16.0.5.1200
- OxygenOS 15.0.0 before 15.0.0.2000
- Affected OnePlus and OPPO devices: full list not published by the vendor (researcher reports many models)
Fixed in
- OxygenOS 16.1.10.500 and later (per CVE record for 16.1 branch)
- OxygenOS 15.0.0.2000 and later (per CVE record for 15.0 branch)
- 16.0 branch: unresolved. The CVE record gives 16.0.5.1200, while the researcher reports 16.0.10.500(EX01) as fixed on OnePlus 15. Verify with the vendor before relying on either build.
- Vendor scale: a secondary report says 151 maintained models were patched by 28 Sep 2026 and 18 were pending. Not verified against OnePlus.
Workaround
Unknown. No vendor workaround found. Install the latest OxygenOS update.
Exploitation
- Not listed in CISA KEV; EPSS below 1%
- CISA SSVC: exploitation none, not automatable, total technical impact
- A detailed public write-up (24 Sep 2026) describes the full chain on OnePlus 15 and OnePlus 12 Pro; no standalone PoC repository found
- No evidence of in-the-wild exploitation found; this does not prove absence
Our recommendation
- Inventory all OnePlus and OPPO devices, including BYOD phones
- Enforce the latest OxygenOS update through MDM and verify the installed build
- Block or restrict sideloading and unmanaged app installs
- Do not rely on MDM root detection; compromise may go unnoticed
- Check the OnePlus security bulletin directly for the correct fixed build of your branch
- Priority: medium to high for fleets with OnePlus or OPPO devices, low otherwise
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Researcher write-up (nns.ee) blog.nns.ee
- OpenCVE app.opencve.io
- VulDB CVE entry vuldb.com
- VulDB vulnerability entry vuldb.com
- Hexnode threat watch www.hexnode.com
- TechJournal (secondary report) techjournal.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:11.
Original description (NVD)
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.