CVE-2026-70387 OnePlus CVE debrief

Who should care

Android system administrators, OnePlus OxygenOS users, and security teams responsible for patching and vulnerability management should assess exposure and prioritize patching due to the high severity of the vulnerability and potential for arbitrary command execution.

Why it matters

CVE-2026-70387 allows arbitrary command execution in OnePlus OxygenOS via an exposed binder method. Android system administrators and security teams should assess exposure, prioritize patching, and monitor for potential exploitation attempts.

• Potential arbitrary command execution via exposed binder method
• Possible elevation of privileges via SELinux policy weaknesses
• Need for patching and verification to prevent exploitation
• Importance of monitoring and auditing system calls to detect potential exploitation attempts

Technical summary

The olc2 logging HAL exposes a binder method that allows arbitrary command execution via fork() and execl() with a caller-supplied command string. The vulnerability affects OxygenOS versions from 15.0.0 before 15.0.0.2000, from 16.0.0 before 16.0.5.1200, and from 16.1.0 before 16.1.10.500. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution.

Defensive priority

High priority for patching and verification

Recommended defensive actions

• Patch affected OxygenOS versions to prevent arbitrary command execution
• Verify and apply SELinux policy updates to restrict binder access
• Monitor and audit system calls to detect potential exploitation attempts
• Inventory and update affected systems to patched versions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impact. However, additional information on exploitation and victim impact is limited. The vulnerability allows arbitrary command execution via an exposed binder method in the olc2 logging HAL. Affected versions include OxygenOS from 15.0.0 before 15.0.0.2000, from 16.0.0 before 16.0.5.1200, and from 16.1.0 before 16.1.10.500. The olc2 logging HAL exposes a binder method that fork()'s and calls execl('/vendor/bin/sh', 'sh', '-c', cmd,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.