CVE-2026-55286

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Write in Android stpropnci Component

Publication date: 2026-10-05

Last updated on: 2026-10-07

Assigner: Android (associated with Google Inc. or Open Handset Alliance)

Description

In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55286

EUVD

EUVD-2026-92610

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	17.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is an out of bounds write issue in the stpropnci_process function of stpropnci.cc. It occurs due to an incorrect bounds check, which could allow an attacker to write outside the intended memory area. This could lead to local privilege escalation without needing additional execution privileges or user interaction.

Detection Guidance

This vulnerability is specific to Google Android systems and involves a bounds check error in stpropnci_process. Detection requires examining the Android system's stpropnci component for improper memory handling. No direct network detection commands are applicable. Check for system logs or crashes related to stpropnci or privilege escalation events.

Impact Analysis

This vulnerability could allow an attacker with local access to escalate their privileges on the affected system. Since no additional execution privileges or user interaction are required, it poses a significant risk for unauthorized access and potential control over the device.

Compliance Impact

This vulnerability could lead to local privilege escalation, potentially allowing unauthorized access to sensitive data. This may impact compliance with GDPR by risking unauthorized data access or processing, and with HIPAA by compromising protected health information confidentiality.

Mitigation Strategies

Apply the latest security patches from Google for Android systems to address the out of bounds write issue in stpropnci.cc. Monitor official Android security bulletins for updates.

Hi! I’m here to help you understand CVE-2026-55286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70