Live › vulnerability › CVE-2026-70387
Go to dashboardThe olc2 logging HAL on OnePlus OxygenOS exposes a binder method that runs a caller-supplied command through /vendor/bin/sh, and it only checks that the caller is uid 0. A process that reaches root in one of the allowed SELinux domains, such as dumpstate reached from an unprivileged app, can run arbitrary commands in a context holding all Linux capabilities.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of OnePlus devices running the affected OxygenOS builds are exposed, since the flaw sits in the vendor logging HAL on the device itself. The sources do not describe a server or developer-side exposure. Devices already on the fixed builds, and devices running other Android vendors' software, are not affected.
No product ranges from the sources yet.
16.1.10.500 or later on the 16.1 line, 16.0.5.1200 or later on the 16.0 line, or 15.0.0.2000 or later on the 15.0 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
This page as .md · .json · in your agent: get_signal("CVE-2026-70387")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.