CVE-2020-0226

HIGH

Android -10 - Privilege Escalation

Title source: llm
STIX 2.1

Description

In createWithSurfaceParent of Client.cpp, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege in the graphics server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150226994

Exploits (2)

nomisec WORKING POC
by ShaikUsaf · poc
https://github.com/ShaikUsaf/frameworks_native_AOSP10_r33_ShaikUsaf-frameworks_native_AOSP10_r33_CVE-2020-0226
nomisec WORKING POC
by Trinadh465 · poc
https://github.com/Trinadh465/frameworks_native_CVE-2020-0226

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2020-07-01

Scores

CVSS v3 7.8
EPSS 0.0001
EPSS Percentile 2.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-843 CWE-787
Status published
Products (1)
google/android 10.0
Published Jul 17, 2020
Tracked Since Feb 18, 2026