OnePlus OxygenOS 15.0.0/16.0.0/16.1.0 handleEvent os command injection

Summaryinfo

A vulnerability has been found in OnePlus OxygenOS 15.0.0/16.0.0/16.1.0 and classified as very critical. Affected by this vulnerability is the function handleEvent. The manipulation leads to os command injection. This vulnerability is documented as CVE-2026-70386. The attack needs to be performed locally. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in OnePlus OxygenOS 15.0.0/16.0.0/16.1.0. This issue affects the function handleEvent. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.

The advisory is shared at blog.nns.ee. The identification of this vulnerability is CVE-2026-70386 since 08/04/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2026). MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 15.0.0.2000, 16.0.5.1200 or 16.1.10.500 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-107149). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OnePlus

Name

• OxygenOS

Version

• 15.0.0
• 16.0.0
• 16.1.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion