Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.4
CVE-2026-56978: GC component can let local users gain higher privileges
CVE-2026-56978 · published 2 months ago
Summary
A function in the GC component fails to check limits, which can cause it to read data outside its intended area. This mistake allows someone with access to the computer to increase their permission level without needing extra rights or user interaction. Install the latest update from the vendor or apply the provided patch to fix the issue.
What to do
- Update google :unknown: to version Pixel-family specific:2026-09-05.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | android | Android kernel | |
| Android | :unknown: |
>= Pixel-family specific:0, < Pixel-family specific:2026-09-05 Fix: upgrade to Pixel-family specific:2026-09-05
|
Original advisory text
In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privilege...
In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
- https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 Vendor Advisory
- https://source.android.com/security/bulletin/2026-09-01 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.4
High
Type
CWE-120Classic Buffer Overflow
CWE-125Out-of-bounds Read
Timeline
Published1 Sep 2026
Updated9 Oct 2026
First seen8 Sep 2026
Track software like this
Free during beta