CVE-2026-70386 in OxygenOS
Summary
by MITRE • 10/21/2026
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described represents a critical combination of improper input validation and missing authorization controls within the OnePlus OxygenOS operating system environment. This flaw allows any locally installed Android application, regardless of whether it declares specific permissions or requires user interaction beyond initial launch, to execute arbitrary shell commands with root privileges. The attack vector is particularly severe because it operates entirely in the background without requiring social engineering tactics such as phishing or physical access by an attacker after gaining local code execution capabilities on a compromised device.
At its core, this vulnerability stems from two distinct but interconnected defects within the system architecture. First, the atlasservice binder interface exposes a method named setEvent which accepts string parameters for event names and values without performing any authorization checks. This means that any application running on the device can invoke this service endpoint directly through standard Android inter-process communication mechanisms. The second defect lies in how specific events are processed once received by the system. When an event with the name atlas_event_multimedia_audio_dumpsys is triggered, a handler function called OplusAtlasLogWriter::handleEvent takes over processing duties.
The critical technical flaw occurs when this handler copies the caller-supplied value directly into a system property identified as oplus.audio.dumpinfo.type without any sanitization or validation of the input data. This unsanitized string is then passed to an init service named audiodumpinfo via standard Android initialization protocols. The audiodumpinfo service subsequently passes this untrusted user-controlled data directly into the C library function system(), which executes shell commands based on the provided string content. Because this execution context operates within the u:r:dumpstate:s0 SELinux domain, and given that dumpstate typically holds elevated privileges necessary for diagnostic operations, the resulting command execution occurs with root-level access equivalent to uid 0.
This architecture creates a direct path from unprivileged application code to full system compromise. An attacker exploiting this vulnerability can inject malicious shell commands into the oplus.audio.dumpinfo.type property value. Since there are no restrictions on special characters or command separators within the input, an adversary can construct payloads that execute arbitrary binaries, modify system files, install persistent backdoors, or exfiltrate sensitive data stored in protected directories accessible only to root users. The lack of SELinux policy enforcement against this specific execution path further exacerbates the risk, allowing actions that would normally be blocked by mandatory access control mechanisms if they were not initiated through this privileged service chain.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-269 Improvement of Privileges or Access Control due to Incorrect Authorization. The exploitation technique maps closely to MITRE ATT&CK techniques involving local privilege escalation and command injection within mobile operating systems. The ability to execute commands as uid 0 effectively bypasses the Android sandbox model, which is designed specifically to isolate applications from each other and from core system components.
The impact of this vulnerability extends beyond simple remote code execution capabilities since it requires local installation but eliminates the need for user consent or permission grants. This makes detection difficult through standard security monitoring tools that rely on permission usage patterns. Once exploited, an attacker gains persistent control over the device at the highest privilege level available to system services. They can disable security features such as Play Protect, modify bootloader settings if permitted by SELinux policies, access encrypted user data partitions, and manipulate network configurations to facilitate further attacks or command-and-control communications.
Mitigation strategies primarily involve applying vendor-provided software updates that address these specific defects in the atlasservice implementation. For affected versions of OxygenOS ranging from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000, users must ensure their devices are updated to the patched releases where authorization checks have been added to the setEvent interface and input sanitization has been implemented in the OplusAtlasLogWriter::handleEvent function. Until patches are applied, device administrators should restrict application installation sources strictly to trusted repositories and consider using security solutions that monitor for unusual binder service invocations or unexpected system property modifications indicative of exploitation attempts.