Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to…
Priority MEDIUM 47CWE-923Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as well as packages signed with the same key, towards any endpoint within the OS that uses CallerIdentity authentication.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed Meta Horizon OS (Meta Platforms, Inc): v74.0.0.878.1682
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Meta Platforms | Meta Horizon OS | v0.0.0.0.0 to before v74.0.0.878.1682 | v74.0.0.878.1682 | Patch available | CNA |
- Meta Horizon OS VendorMeta Platforms Affected v0.0.0.0.0 to before v74.0.0.878.1682 Fixed in v74.0.0.878.1682 Patch available CNA
Remediation
- Fix · CNA Meta Horizon OS (Meta Platforms, Inc) Fixed in v74.0.0.878.1682
Timeline
- 2026-10-02 Threatist record created from CVE-2026-92173
- 2026-10-03 Alias added: GHSA-x7qm-j22r-cgcw
References
More Meta Platforms vulnerabilities
- TI-2025-34672 An integer overflow vulnerability in the loading of ExecuTorch models can cause… CVSS 3.1CRITICAL 9.8
- TI-2025-34671 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
- TI-2025-34670 Out-of-bounds read in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
- TI-2025-34669 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
- TI-2025-21707 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
- TI-2025-21706 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-92173 · CVE Program
- CVE-2026-92173 · NVD
- FIRST EPSS
- GHSA-x7qm-j22r-cgcw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences