Read the docs
TI-2026-78561 Aliases CVE-2026-70387GHSA-cwgc-9268-23h4

Command execution in OnePlus OxygenOS via exposed logging HAL method

Priority LOW 38CWE-749Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

OnePlus OxygenOS on Android is affected from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000. The olc2 logging HAL exposes a binder method that runs a shell command from a caller-supplied string, and its only check is that the caller has uid 0 (CWE-749, CWE-863). A local process running as root in an SELinux domain with binder access to the HAL can execute arbitrary commands, and the spawned shell holds all Linux capabilities.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00308 23rd percentileScored 2026-11-07
Fix Fixed OxygenOS (OnePlus): 16.0.5.1200, 15.0.0.2000

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OnePlusOxygenOS16.0.0 to before 16.0.5.1200; 15.0.0 to before 15.0.0.200016.0.5.1200, 15.0.0.2000Patch availableCNA
  • OxygenOS VendorOnePlus Affected 16.0.0 to before 16.0.5.1200; 15.0.0 to before 15.0.0.2000 Fixed in 16.0.5.1200, 15.0.0.2000 Patch available CNA

Remediation

The fixed versions are OxygenOS 16.0.5.1200 and 15.0.0.2000.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA OxygenOS (OnePlus) Fixed in 16.0.5.1200, 15.0.0.2000

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OnePlus OxygenOS 15.0.0.2000, 16.0.5.1200

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-78560 OnePlus OxygenOS improper neutralization of special elements vulnerabilityPriority HIGH 72
    Show all 2 records →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-70387
  2. 2026-10-21 Alias added: GHSA-cwgc-9268-23h4
  3. 2026-10-22 Priority changed: MEDIUM → LOW
  4. 2026-10-22 Affected versions changed · CNA
  5. 2026-10-29 CISA SSVC decision points changed

References

Other 1

  • TI-2026-78560 OnePlus OxygenOS improper neutralization of special elements vulnerability CVSS 4.0HIGH 8.5
  • TI-2025-09349 OnePlus OxygenOS Telephony provider permission bypass CVSS 4.0HIGH 8.2
  • TI-2017-03628 OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands… CVSS 3.0CRITICAL 9.8
  • TI-2017-03626 An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. CVSS 3.0CRITICAL 9.8
  • TI-2017-08167 The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before… CVSS 3.0CRITICAL 9.8
  • TI-2023-11464 A remote code execution vulnerability in the webview component CVSS 3.1CRITICAL 9.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences