CVE-2026-70387
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
On OnePlus OxygenOS for Android, the olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string; the only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in those domains (including dumpstate, reachable from an unprivileged app) obtains arbitrary command execution, with the spawned shell landing in the u:r:vendor_qti_init_shell:s0 SELinux context holding all Linux capabilities.
Risk Assessment
An unprivileged app can indirectly achieve arbitrary command execution with full Linux capabilities, leading to complete compromise of the device.
Recommendation
Update OxygenOS to 16.1.10.500, 16.0.5.1200, or 15.0.0.2000 (or later) for the 16.1, 16.0, and 15.0 branches respectively.
Other vulnerabilities in OxygenOS
See all- CVE-2017-5626Critical
OxygenOS before version 4.0.2 on OnePlus 3 and 3T has two hidden fastboot oem commands that allow an attacker to lock/unlock the bootloader without user confirmation. This allows for persistent code execution with high privileges and complete access to user data.
- CVE-2017-5624Critical
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T that allows an attacker to persistently make the (locked) bootloader start with dm-verity disabled. This results in the kernel not verifying the system partition, potentially allowing for persistent code execution and privilege escalation.
Original NVD description (English source)
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS