Key points
- CVE-2026-70387 carries a CVSS score of 8.4, classified as high severity.
- The flaw affects OxygenOS versions 16.1.0 up to 16.1.10.500, 16.0.0 up to 16.0.5.1200, and 15.0.0 up to 15.0.0.2000.
- No patch availability is confirmed in the source material for these specific version ranges.
OnePlus OxygenOS contains a high severity vulnerability that permits arbitrary command execution. The National Vulnerability Database lists CVE-2026-70387 with a CVSS score of 8.4.
What happened
The vulnerability stems from an exposed dangerous method in the olc2 logging hardware abstraction layer. This component exposes a binder interface that forks a new process and executes a shell command. The command string is supplied directly by the caller of the binder method. The implementation uses execl to invoke /vendor/bin/sh with the user provided input.
Authorization for this action relies solely on checking if the calling user ID is zero. The system grants binder access to this HAL to a wide client attribute via SELinux policy. Consequently, any process running with user ID zero within those domains can trigger the execution. This includes the dumpstate process, which is reachable from unprivileged applications through a separate vulnerability.
The spawned shell operates within the u:r:vendor_qti_init_shell:s0 SELinux context. This domain holds all Linux capabilities due to a policy type transition. The combination of incorrect authorization and exposed functionality allows an attacker to run commands with elevated privileges. The issue affects specific ranges of OxygenOS versions, as detailed in the key points.
Why it matters
The flaw enables an unprivileged application to achieve arbitrary command execution on the device. By leveraging the reachable dumpstate process, an attacker can bypass standard permission boundaries. The resulting shell process possesses all Linux capabilities, granting near total control over the system. This level of access allows for data theft, system modification, or installation of persistent malware.
The vulnerability is rated high severity, not critical, according to the CVSS score. However, the impact on confidentiality, integrity and availability is significant. Organizations managing fleets of OnePlus devices must assess exposure based on the affected version ranges. The lack of confirmed patches in the source material means affected devices remain vulnerable until updates are released.
What happens next
- Verify the OxygenOS version on all managed OnePlus devices.
- Identify devices running versions prior to 16.1.10.500, 16.0.5.1200, or 15.0.0.2000.
- Monitor vendor communications for official security updates addressing CVE-2026-70387.
- Restrict the installation of untrusted applications on affected devices to reduce attack surface.
- Review SELinux policies and binder permissions as part of a broader security audit.
Patch priority
Teams usually prioritise devices exposed to untrusted applications or external networks. Check whether affected devices are used in high risk environments where malware introduction is likely. Roll out any future fixes in phases to ensure stability. Back up critical data before applying system updates. If no fix exists, consider isolating affected devices from sensitive networks. Reduce exposure by disabling unnecessary services or restricting app installations. Focus on devices running the oldest affected versions first. Ensure logging remains active to detect suspicious command execution patterns.
What to do and how to stay safe: OnePlus
- Audit your device inventory for OnePlus units running the affected OxygenOS versions.
- Restrict app installations to trusted sources on vulnerable devices to mitigate risk.
- Monitor vendor channels for the release of security patches addressing this CVE.
- Isolate high value devices from untrusted networks until a fix is confirmed.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which OnePlus OxygenOS versions are affected by CVE-2026-70387?
Versions from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000 are affected.
Is this vulnerability rated as critical?
No, the National Vulnerability Database rates it as high severity with a CVSS score of 8.4.
Does a patch exist for this vulnerability?
The source material does not confirm the availability of a patch for the affected versions.
