CVE-2026-49885: Elevation of privilege in Google Android

This vulnerability involves an integer overflow in the rw_t4t_update_file function within the rw_t4t.cc component of Google Android. The overflow leads to a possible out-of-bounds write, which can be leveraged by an attacker to escalate privileges locally without needing any prior execution privileges or user interaction. The affected versions explicitly include Android 14 through 17 and 16-qpr2.

Successful exploitation allows a local attacker to escalate privileges on the affected Android device. No additional execution privileges or user interaction are required, increasing the risk of exploitation in local attack scenarios. There is no indication of remote exploitation or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data.