CVE-2026-55351: VPU Integer Overflow Privilege Escalation

CVE-2026-55351 Overview

CVE-2026-55351 is an integer overflow vulnerability [CWE-190] in the Video Processing Unit (VPU) component addressed in the Android Security Bulletin for September 2026. The flaw causes an out-of-bounds write when the overflowed value is used to size or index a memory operation. Successful exploitation enables local privilege escalation without user interaction and without requiring additional execution privileges. An attacker with local access and low privileges on an affected device can leverage the flaw to gain elevated permissions on the target system.

Critical Impact
Local privilege escalation through an out-of-bounds write in the VPU driver, requiring no user interaction.

Affected Products

Android devices incorporating the affected VPU component
Pixel devices covered by the September 2026 Android Security Bulletin
See the Android Security Bulletin September 2026 for the definitive list of affected builds

Discovery Timeline

2026-09-15 - CVE-2026-55351 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-55351

Vulnerability Analysis

The vulnerability resides in the Video Processing Unit (VPU) subsystem. An integer overflow occurs during a size or length calculation that is subsequently used to bound a memory write operation. When the arithmetic wraps, the driver allocates or indexes a buffer that is smaller than the data actually written, producing an out-of-bounds write into adjacent kernel memory.

Out-of-bounds writes in kernel-resident drivers such as the VPU can corrupt kernel data structures, function pointers, or object metadata. On Android, this class of memory corruption typically translates into a local privilege escalation primitive because the VPU driver executes in a highly privileged context.

The attacker must already possess local, low-privilege code execution on the device, for example through a malicious or compromised application. Exploitation requires no user interaction and no additional execution privileges beyond those of an ordinary app.

Root Cause

The defect is an integer overflow [CWE-190] in a length or size computation within the VPU code path. The overflowed value is trusted by downstream logic, leading to an undersized allocation or an out-of-range index used during a write.

Attack Vector

A local attacker running unprivileged code on an affected Android device issues crafted requests to the VPU interface. The malformed parameters trigger the integer overflow and drive the out-of-bounds write, corrupting kernel memory to escalate privileges. No physical access, network access, or user interaction is required.

No public proof-of-concept exploit is referenced in the CVE record. Technical details are available in the Android Security Bulletin September 2026.

Detection Methods for CVE-2026-55351

Indicators of Compromise

Unexpected kernel crashes or panics referencing the VPU driver or media processing components
Applications repeatedly invoking VPU ioctl or system-call interfaces with anomalous size or length parameters
Unauthorized privilege transitions from unprivileged application UIDs to system or root contexts

Detection Strategies

Monitor Android device logs (logcat, dmesg) for VPU-related faults, SELinux denials, or memory corruption signatures
Inspect installed applications for unsigned or sideloaded packages that access media or VPU device nodes
Correlate crash telemetry from Mobile Threat Defense platforms with the affected VPU component

Monitoring Recommendations

Track patch level compliance against the September 2026 Android Security Bulletin across the mobile fleet
Alert on runtime behavior indicative of local privilege escalation, including unexpected setuid transitions and access to protected directories
Ingest mobile telemetry into a centralized data lake to correlate crash patterns, application installs, and privilege changes at scale

How to Mitigate CVE-2026-55351

Immediate Actions Required

Apply the September 2026 Android security patch level or later to all affected devices
Prioritize patching for devices used by high-value users and those permitting sideloaded applications
Remove untrusted applications, especially those requesting access to media or hardware acceleration interfaces

Patch Information

Google addressed CVE-2026-55351 in the September 2026 Android Security Bulletin. Device manufacturers integrate the fix into their monthly security patch level. Refer to the Android Security Bulletin September 2026 for patch identifiers and build numbers.

Workarounds

No vendor-supplied workaround is documented; apply the vendor patch as the authoritative remediation
Restrict installation of applications to trusted sources such as Google Play and enforce enterprise mobility management (EMM) policies
Enforce a minimum Android security patch level in mobile device management (MDM) compliance policies to block non-compliant devices from corporate resources

bash

# Verify the Android security patch level on a device
adb shell getprop ro.build.version.security_patch
# Expected output should be 2026-09-01 or later