CVE-2026-24088
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
A cryptographic issue while processing a specific partition allows unauthorized write access to load a customized bootloader.
Risk Assessment
An attacker can take control of the boot process by installing a malicious bootloader, leading to full device compromise.
Recommendation
Apply vendor patches for partition handling and strengthen cryptographic mechanisms verifying bootloader integrity.
Other vulnerabilities in Android
See all- CVE-2016-0833High
Android allows users to cause a denial of service.
- CVE-2025-48595HighActively exploited
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.
- CVE-2025-48626Critical
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2016-3877Critical
Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.
- CVE-2026-49189High
Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.
- CVE-2026-28586Low
In multiple functions of AppOpsService.java, there is a missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed.
- CVE-2026-28581Medium
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, a logic error allows making an emergency call without proper privileges.
- CVE-2026-28580High
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.
- CVE-2026-28578Medium
In multiple functions of DevicePolicyManagerService.java, a desync from persistence due to improper input validation could lead to local denial of service.
- CVE-2026-28577High
In the addWindow method of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.
Original NVD description (English source)
Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.