CVE Feed

    Dashboard / CVE / CVE-2026-70386

    CVE-2026-70386

    Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

    Published:Oct 21, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 21, 2026
    EPSS Score:0.01221
    CVSS Score:8.5

    Affected Products

    Vendor
    Oneplus
    Product
    Oxygenos

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-70387 (CVSS 8.4) — Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android.…
    CVE-2025-10184 (CVSS 8.2) — The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the sy…
    CVE-2017-5947 (CVSS 6.8) — An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker…
    CVE-2017-8851 (CVSS 5.9) — An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X…
    CVE-2016-10370 (CVSS 7.5) — An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image…
    CVE-2017-5948 (CVSS 5.9) — An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to dow…
    CVE-2017-8850 (CVSS 5.9) — An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlu…
    CVE-2017-5625 (CVSS 4.6) — In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader t…
    CVE-2017-5622 (CVSS 5.9) — With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform …
    CVE-2017-5623 (CVSS 6.6) — An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the boot…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High