CVE-2026-70386

Deferred Deferred - Pending Action

OS Command Injection in OnePlus OxygenOS

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: ENISA

Description

Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-70386

EUVD

EUVD-2026-107149

Affected Vendors & Products

Vendor	Product	Version / Range
OnePlus	OxygenOS	16.1.0
OnePlus	OxygenOS	16.0.0
OnePlus	OxygenOS	15.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-70386 is an OS command injection and missing authorization flaw in OnePlus OxygenOS on Android. It allows any locally installed app to execute arbitrary shell commands as root without user interaction or special permissions. The vulnerability combines two issues: an unprotected AtlasService interface and an unsanitized system property that triggers a root-owned process.

Detection Guidance

Check for unauthorized use of AtlasService.setEvent or audioDumpInfo processes. Look for suspicious system property changes to oplus.audio.dumpinfo.type. Monitor for root-owned processes spawned from untrusted apps.

Impact Analysis

This vulnerability enables attackers to gain full root access on affected OnePlus devices. With root access, attackers can install malware, steal sensitive data, bypass security controls, or take complete control of the device. The exploit works silently without requiring user permissions or interaction.

Compliance Impact

This vulnerability allows arbitrary root-level command execution on affected OnePlus devices, which could lead to unauthorized access to sensitive user data. For GDPR, this could result in violations of data confidentiality and integrity requirements. For HIPAA, it may compromise protected health information if accessed through the device. The lack of authorization checks and root access could enable data exfiltration or tampering, directly impacting compliance with these regulations.

Mitigation Strategies

Update OxygenOS to the latest patched version (16.1.10.500 or later, 16.0.5.1200, or 15.0.0.2000+). Disable unnecessary telemetry services like AtlasService if updates are unavailable.

Hi! I’m here to help you understand CVE-2026-70386. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...