The vulnerability CVE-2026-22078 affects OPPO O+ Connect version 16.0.33. It arises because the IPC service fails to authenticate clients, enabling external applications to escalate privileges via the IPC channel. This incorrect privilege assignment (CWE-266) can lead to confidentiality, integrity, and availability impacts as indicated by the CVSS vector. The CVSS 3.1 base score is 7.3 (high), reflecting local attack vector with low attack complexity, requiring low privileges but user interaction, and resulting in partial confidentiality and integrity loss and high availability impact. No patch or official remediation level has been published by the vendor as of the provided data.

Exploitation of this vulnerability allows an attacker with local access and limited privileges to escalate their privileges and perform sensitive actions through the IPC channel of O+ Connect. This can lead to partial loss of confidentiality and integrity, and a high impact on availability of the affected system or service.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, limit local access to trusted users and monitor for suspicious activity related to O+ Connect IPC interactions.