{"cve":"CVE-2026-70386","nvd":{"published":"2026-10-21T09:17:07.787","modified":"2026-10-22T16:58:51.997","status":"Deferred","description":"Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared \nand no user interaction beyond launching it, can execute arbitrary shell\n commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects \ncombine: (a) OnePlus's atlasservice binder interface accepts \nsetEvent(String8 name, String8 value) from any caller without \nauthorization, and (b) one event handler \n(OplusAtlasLogWriter::handleEvent, matching event name \natlas_event_multimedia_audio_dumpsys) copies the caller-supplied value \ninto the system property oplus.audio.dumpinfo.type and starts the root \ninit service audiodumpinfo, which passes that property value unsanitized\n to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.5},"cvss_v3":null,"cwes":["CWE-78","CWE-862"],"references":["https://blog.nns.ee/2026/09/24/oneplus-root/"],"products":[],"source":"nvd","synced_at":"2026-10-23T16:39:26.291718493+00:00"},"epss":{"cve":"CVE-2026-70386","score":0.01221,"percentile":0.68488,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}