Authorization Flaw in OnePlus OxygenOS Android Framework
CVE-2026-70387

8.4HIGH

Key Information:

Vendor

Oneplus

Status
Oxygenos
Vendor
CVE Published:
21 October 2026

What is CVE-2026-70387?

An incorrect authorization vulnerability in OnePlus OxygenOS allows arbitrary command execution by exploiting an exposed method in the olc2 logging HAL. The vulnerability arises when this method, which lacks proper access controls, permits uid-0 processes to execute shell commands. This could enable unprivileged apps to gain elevated privileges, potentially jeopardizing the device's security.

Affected Version(s)

OxygenOS Android 16.1.0 < 16.1.10.500

OxygenOS Android 16.0.0 < 16.0.5.1200

OxygenOS Android 15.0.0 < 15.0.0.2000

References

https://blog.nns.ee/2026/09/24/oneplus-root/
technical-description

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rasmus Moorats
CERT-EE
.