CVE-2026-28653

HighCVSS 7.8/10Last modified Sep 15, 2026

Description

In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787CWE-1190

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2026
Last modified
Sep 15, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-286557.8In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This coulCVE-2026-286567.3In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to lCVE-2026-286577.8In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. ThCVE-2026-286587.8In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation CVE-2026-286597.8In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalaCVE-2026-286603.3In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local informatCVE-2026-286628.0In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead tCVE-2026-286637.8In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL BypassCVE-2026-286647.8In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalCVE-2026-286668.8In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering checkCVE-2026-286675.5In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local informatiCVE-2026-286687.8In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalatio
CVE-2026-28653: High severity, CVSS 7.8 | Vulnix