CVE-2026-55266

Summary

The flaw is an out-of-bounds write vulnerability in Google's Android libufdt library during qsort operations, which can be triggered by resource exhaustion. This allows local attackers to escalate privileges without needing additional execution privileges or user interaction, making it particularly dangerous for system integrity.

Exploitability

Exploitation is relatively straightforward as it requires only local access and leverages resource exhaustion to trigger the out-of-bounds write, with no user interaction needed.

Blast radius

The impact could be significant across Android devices that use the affected libufdt library, potentially allowing attackers to gain full system privileges on vulnerable devices.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Android 14 or later, as this version includes the fixed libufdt implementation that resolves the qsort out-of-bounds write vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.