AGL app-framework-binder up to 19.90.0 src/afb-supervision.c on_supervision_call api/verb improper authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in AGL app-framework-binder up to 19.90.0. This issue affects the function on_supervision_call of the file src/afb-supervision.c. Executing a manipulation of the argument api/verb can lead to improper authorization. This vulnerability is registered as CVE-2026-37525. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability has been found in AGL app-framework-binder up to 19.90.0 and classified as critical. This vulnerability affects the function on_supervision_call of the file src/afb-supervision.c. The manipulation of the argument api/verb with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c explicitly nullifies the request credentials by calling afb_context_change_cred(&xreq->context, NULL) before dispatching an attacker-controlled API call via xapi->itf->call(xapi->closure, xreq). The NULL propagation chain through afb-context.c:110 (context->credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context->credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14.

The advisory is shared for download at gerrit.automotivelinux.org. This vulnerability was named CVE-2026-37525 since 04/06/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-26681). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• AGL

Name

• app-framework-binder

Version

• 19.0
• 19.1
• 19.2
• 19.3
• 19.4
• 19.5
• 19.6
• 19.7
• 19.8
• 19.9
• 19.10
• 19.11
• 19.12
• 19.13
• 19.14
• 19.15
• 19.16
• 19.17
• 19.18
• 19.19
• 19.20
• 19.21
• 19.22
• 19.23
• 19.24
• 19.25
• 19.26
• 19.27
• 19.28
• 19.29
• 19.30
• 19.31
• 19.32
• 19.33
• 19.34
• 19.35
• 19.36
• 19.37
• 19.38
• 19.39
• 19.40
• 19.41
• 19.42
• 19.43
• 19.44
• 19.45
• 19.46
• 19.47
• 19.48
• 19.49
• 19.50
• 19.51
• 19.52
• 19.53
• 19.54
• 19.55
• 19.56
• 19.57
• 19.58
• 19.59
• 19.60
• 19.61
• 19.62
• 19.63
• 19.64
• 19.65
• 19.66
• 19.67
• 19.68
• 19.69
• 19.70
• 19.71
• 19.72
• 19.73
• 19.74
• 19.75
• 19.76
• 19.77
• 19.78
• 19.79
• 19.80
• 19.81
• 19.82
• 19.83
• 19.84
• 19.85
• 19.86
• 19.87
• 19.88
• 19.89
• 19.90.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion