CVE-2026-70386 Details
Description
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
A vulnerability in OnePlus OxygenOS on Android allows any locally installed application to execute arbitrary shell commands as the root user, without requiring special permissions or user interaction beyond launching the app. This issue arises from a combination of improper authorization in the atlasservice binder interface and the handling of event data, which is passed unsanitized to the system. The vulnerability affects OxygenOS versions 16.1.0 prior to 16.1.10.500, 16.0.0 prior to 16.0.5.1200, and 15.0.0 prior to 15.0.0.2000.
OnePlus has released patches for this vulnerability in the OxygenOS 16.1.0 line starting from version 16.0.10.500, in the 16.0.0 line from version 16.0.5.1200, and in the 15.0.0 line from version 15.0.0.2000.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.nns.ee/2026/09/24/oneplus-root/ | CISA-ADP | ExploitRemedyTechnical Analysis |
| https://blog.nns.ee/2026/09/24/oneplus-root/ | ENISA | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | ENISA |
| CWE-862 | Missing Authorization | ENISA |
Affected Products
| Product | Versions |
|---|---|
| OnePlus OxygenOS | >= 16.1.0, < 16.1.10.500 >= 16.0.0, < 16.0.5.1200 >= 15.0.0, < 15.0.0.2000 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | CVE Modified | ENISA |
| Oct 21, 2026 | New CVE Received | ENISA |