{"id":"CVE-2026-70387","revision":"044789f96f9e4ea3b03fcb6aef923b9a","records":[{"revision":"044789f96f9e4ea3b03fcb6aef923b9a","observedAt":"2026-10-29T21:14:49.558+00:00","statement":{"source":"cve-program","id":"CVE-2026-70387","aliases":[],"title":"OnePlus OxygenOS exposed dangerous method vulnerability","description":"Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl(\"/vendor/bin/sh\", \"sh\", \"-c\", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities.\u00A0This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.","state":0,"publishedAt":"2026-10-21T09:07:56.492+00:00","modifiedAt":"2026-10-29T19:09:35.392+00:00","affected":[{"ecosystem":"Vendor product","name":"OxygenOS","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"OnePlus\",\n                    \"product\": \"OxygenOS\",\n                    \"platforms\": [\n                        \"Android\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"unknown\",\n                            \"version\": \"16.1.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"16.0.0\",\n                            \"lessThan\": \"16.0.5.1200\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"15.0.0\",\n                            \"lessThan\": \"15.0.0.2000\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.4,"severity":"HIGH"}],"references":["https://blog.nns.ee/2026/09/24/oneplus-root/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-70387","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-70387","identifiers":["CVE-2026-70387"]},"retained":false,"historicalAffected":[]}],"coverage":[]}