TI-2026-62242 Aliases CVE-2026-92172 GHSA-jg3q-pm4q-v527

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a…

MEDIUM 40CWE-923Published 2026-09-30 · Updated 2026-10-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the com.oculus.horizon package towards any endpoint within the OS that uses CallerIdentity authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00288 21st percentileScored 2026-11-07

Fix Fixed Meta Horizon OS (Meta Platforms, Inc): v66.0.0.733.524

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta Platforms	Meta Horizon OS	v0.0.0.0.0 to before v66.0.0.733.524	v66.0.0.733.524	Patch available	CNA

Meta Horizon OS VendorMeta Platforms Affected v0.0.0.0.0 to before v66.0.0.733.524 Fixed in v66.0.0.733.524 Patch available CNA

Remediation

Fix · CNA Meta Horizon OS (Meta Platforms, Inc) Fixed in v66.0.0.733.524

Timeline

2026-10-02 Threatist record created from CVE-2026-92172
2026-10-03 Alias added: GHSA-jg3q-pm4q-v527

References

Other 1

https://www.facebook.com/security/advisories/cve-2026-92172

TI-2025-34672 An integer overflow vulnerability in the loading of ExecuTorch models can cause… CVSS 3.1CRITICAL 9.8
TI-2025-34671 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
TI-2025-34670 Out-of-bounds read in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
TI-2025-34669 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
TI-2025-21707 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
TI-2025-21706 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences