Read the docs
TI-2026-78560 Aliases CVE-2026-70386GHSA-mmh8-7mj5-vp22

OnePlus OxygenOS improper neutralization of special elements vulnerability

Priority HIGH 72CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78 and CWE-862.

Summary

Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01379 72nd percentileScored 2026-11-07
Fix Fixed OxygenOS (OnePlus): 16.0.5.1200, 15.0.0.2000

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OnePlusOxygenOS16.0.0 to before 16.0.5.1200; 15.0.0 to before 15.0.0.200016.0.5.1200, 15.0.0.2000Patch availableCNA
  • OxygenOS VendorOnePlus Affected 16.0.0 to before 16.0.5.1200; 15.0.0 to before 15.0.0.2000 Fixed in 16.0.5.1200, 15.0.0.2000 Patch available CNA

Remediation

  • Fix · CNA OxygenOS (OnePlus) Fixed in 16.0.5.1200, 15.0.0.2000

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OnePlus OxygenOS 15.0.0.2000, 16.0.5.1200

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-78561 Command execution in OnePlus OxygenOS via exposed logging HAL methodPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-70386
  2. 2026-10-21 Alias added: GHSA-mmh8-7mj5-vp22
  3. 2026-10-22 Priority changed: MEDIUM → LOW
  4. 2026-10-22 Affected versions changed · CNA
  5. 2026-10-30 CISA SSVC decision points changed
  6. 2026-10-30 Priority changed: LOW → HIGH

References

Other 1

  • TI-2025-09349 OnePlus OxygenOS Telephony provider permission bypass CVSS 4.0HIGH 8.2
  • TI-2017-03628 OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands… CVSS 3.0CRITICAL 9.8
  • TI-2017-03626 An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. CVSS 3.0CRITICAL 9.8
  • TI-2017-08167 The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before… CVSS 3.0CRITICAL 9.8
  • TI-2023-11464 A remote code execution vulnerability in the webview component CVSS 3.1CRITICAL 9.8
  • TI-2017-03568 An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. CVSS 3.0HIGH 8.1
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences