CVE-2026-0010: Android Frameworks AV Package Local Privilege Escalation Vulnerability
Summary
CVE-2026-0010: In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. Affects platform/frameworks/av across 4 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks AV package is a core component of the Android operating system, responsible for handling audio and video functionalities. It provides essential services for media playback, recording, and processing. This package is crucial for applications that rely on multimedia capabilities, making its security paramount. The vulnerability in question arises from a missing bounds check in the IDrmManagerService component, which can lead to serious security implications.
Vulnerability Detail
In the onTransact method of IDrmManagerService.cpp, there is a potential out-of-bounds write due to a missing bounds check. This flaw allows an attacker to escalate privileges locally without requiring additional execution privileges. The vulnerability can be exploited without user interaction, making it particularly dangerous as it could allow unauthorized access to sensitive system resources.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The CVE-2026-0010 vulnerability in the Android Frameworks AV package poses a significant risk due to its potential for local privilege escalation. Users are strongly advised to update their packages to the latest patched versions to ensure their systems remain secure.
See every vulnerability recorded for platform/frameworks/av →
FAQ
CVE-2026-0010 is a vulnerability in the Android Frameworks AV package that allows local privilege escalation due to an out-of-bounds write.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to use the Vulert playground.
The vulnerability could allow unauthorized users to escalate their privileges, potentially gaining access to sensitive system resources and compromising the security of the device.
No, user interaction is not needed for exploitation, making it particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize updating the package to the patched version as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/av.
