OnePlus OxygenOS Binder Flaw Allows Arbitrary Command Execution

OnePlus OxygenOS contains a high-severity vulnerability that exposes a dangerous method within its logging hardware abstraction layer. This flaw allows uid-0 processes, which are reachable from unprivileged apps, to gain arbitrary command execution by exploiting incorrect authorisation checks on a binder interface.

What happened

The vulnerability, tracked as CVE-2026-70387, stems from an exposed binder method in the olc2 logging HAL. According to the NVD record, this method forks a process and executes a caller-supplied command string using the vendor shell. The only authorisation check verifies if the calling user ID is zero, which is insufficient to prevent abuse from lower-privilege domains.

Because SELinux policy grants binder access to this HAL for a wide client attribute, any uid-0 process in those domains can trigger the execution. This includes the dumpstate process, which is reachable from unprivileged applications via a separate vulnerability. The spawned shell lands in a SELinux context that holds all Linux capabilities, effectively granting full system control to the attacker.

Why it matters

This issue affects a broad range of OxygenOS versions, including 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000. The combination of weak binder authorisation and permissive SELinux policies creates a significant escalation path. Attackers can move from standard app permissions to full root-equivalent access by leveraging the reachable uid-0 process.

Next steps

• Review internal device inventories to identify units running affected OxygenOS versions.
• Prioritise patching devices to the latest stable release as soon as updates are available.
• Audit SELinux policies on custom Android builds for similar overly permissive binder access grants.
• Monitor for unusual shell processes spawned by logging services in enterprise environments.

Detection notes

Security teams should monitor for unexpected process executions originating from logging hardware abstraction layers. Look for binder transactions that trigger shell commands from non-system applications. Check for new processes landing in high-privilege SELinux contexts, particularly those with full Linux capabilities. Investigate any dumpstate activity initiated by unprivileged apps, as this indicates potential exploitation of the initial access vector. Verify that all binder interfaces enforce strict user ID checks rather than relying on broad domain attributes.

What to do and how to stay safe: OnePlus

• Audit your mobile device management policies to ensure all corporate devices are running patched OS versions.
• Implement application whitelisting to restrict which apps can interact with system-level logging services.
• Monitor network traffic for indicators of compromise that suggest command-and-control activity from compromised devices.
• Once the vendor provides an update, deploy it immediately to all affected endpoints to mitigate the risk.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific OnePlus OxygenOS versions are affected by CVE-2026-70387?

Versions 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000 are affected.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-70387 with a CVSS score of 8.4, which is classified as high.

Does this vulnerability require user interaction to exploit?

The source material indicates that an unprivileged app can reach the dumpstate process, suggesting no direct user interaction is required for the exploit chain.