CVE-2026-20535

Executive Summary

CVE-2026-20535 is a missing permission authorization vulnerability (CWE-862) in an Android Interface Definition Language (AIDL) interface that permits a locally-positioned attacker to escalate privileges to the System level without any user interaction. The vulnerability is only reachable by an actor who has already obtained the System privilege, meaning the flaw is a second-stage privilege escalator across a trust boundary between Android system components rather than a remote entry point. Affected Android builds are those exposing the vulnerable AIDL service prior to patch ALPS11185216; no affected version range, CVSS score, or EPSS estimate has been published by NVD.

Technical Analysis

AIDL is Android's mechanism for defining stable IPC interfaces between processes; Binder serializes calls to these interfaces and dispatches them into the service process. The Binder framework enforces in-process authorization through mechanisms such as checkCallingPermission() and checkCallingOrSelfPermission(), which consult the caller's UID/PID against an Android permission string. The CWE-862 classification ("Missing Authorization") indicates that within the affected AIDL implementation, such a check is absent, incomplete, or not enforced on the relevant transaction path, so a caller that reaches the interface is not validated against the required permission before the privileged operation is executed.

Because the flaw is exposed over the AIDL/Binder surface, the practical attack surface is any local process that can bind to or transact against the affected service. Android's Binder access model normally limits that surface to same-UID or explicitly permitted callers; a missing check widens it to any local process able to reference the interface. The NVD description explicitly qualises exploitability: "if a malicious actor has already obtained the System privilege." That indicates the vulnerable operation executes in an elevated context (System / system_server-adjacent) and that the missing check fails to constrain an already-privileged principal from performing an operation it should not be permitted to perform — a lateral elevation within the privileged subsystem.

User interaction is explicitly not required for exploitation. There is no CVSS vector, no CWE sub-vector detail, no function name, no interface name, and no file path disclosed in the available data; the specifics of the AIDL interface, transaction code, and required permission are not published. No public proof of concept, Nuclei template, or exploit code is available.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description and is not derived from observed code.

1. Reconnaissance / target identification. The attacker requires code execution in a local process on the victim device. In the Android threat model this is achieved through the standard one-two chain used against the platform: a first-stage vulnerability (or a malicious/compromised pre-installed application with a foothold) delivers the initial code execution context, and the attacker enumerates the accessible Binder services. Because AIDL interfaces are publishable through the ServiceManager, an attacker in-process can enumerate registered service names and query interfaces reachable from its UID context.
2. Triggering the specific flaw class. The attacker obtains or already holds System privilege (as the description states), then sends Binder transactions to the affected AIDL interface. Because authorization is missing (CWE-862), the transaction is not rejected on the basis of the caller's permission; the transaction proceeds to the privileged operation. No user interaction is needed — there is no UI prompt, no confirmation dialog, and no per-call consent gate documented.
3. Payload / execution method at the class level. At the vulnerability-class level, the malicious actor invokes the under-protected IPC operation directly, passing whatever arguments the AIDL interface accepts. Since the underlying operation is privileged and untrusted-input validated only incidentally (if at all), the payload is a normal Binder parcel rather than a memory-corruption primitives; the privilege escalation is achieved by authorization bypass, not by a memory-safety violation. No specific interface name, transaction code, or argument format is available in the provided data.
4. Post-exploitation impact. The attacker gains additional System-level capability beyond what the already-held System privilege should confer — i.e., access to operations, system state, or subsystems gated behind the missing permission. Depending on what the AIDL interface governs, the outcome is typically the ability to modify protected system state, cross additional trust boundaries, or install persistence in a context that survives across the original foothold.

Absent a published advisory, prior-function exploitation of this CVE is assessed as non-trivial: it requires a pre-existing System-privilege foothold and a local execution primitive, which raises the barrier versus a remote or unauthenticated flaw.

Impact Assessment

• Confidentiality / Integrity: The CWE-862 class implies unauthorized privileged operation. Without a CVSS vector, we cannot assign numeric subscores; qualitatively, the impact is an elevation of privilege within the Android system to the System level — a boundary that normally gates system service configuration, cross-component data access, and persisted platform settings.
• Availability: No availability-impact evidence is present; the description does not assert denial-of-service behavior.
• Blast radius: Local to a single device. There is no indication of remote exploitation, no network exposure, and no evidence that the flaw spills beyond the compromised device. The user-interaction-none property increases "silent" business risk: no prompt is observable, so user education does not help.
• Affected systems: Android devices exposing the affected AIDL service on builds that have not received ALPS11185216. No OSV package, affected version range, or build fingerprints are published, so scoping must be done against the vendor's own build/patch state rather than from this data.
• Mitigating factors: Requires prior System privilege and local code execution; no public exploit, no KEV listing, no EPSS score. CISA KEV is NO.

Detection Guidance

Detection is hampered by the fact that the vulnerable interface name, transaction code, and required permission are not disclosed. The rules below detect behavior class — anomalous privileged Binder/AIDL transactions and privilege-escalation telemetry — and must be tuned against the interface name once the vendor advisory is published. They will not, on their own, prove exploitation.

Sigma Rule

title: Android AIDL Privilege Escalation via Missing Permission Check (CVE-2026-20535)
id: 3f6c9a2e-2053-4b7a-9c1e-000000000000
status: experimental
description: Detects local Android process attempting privileged AIDL/Binder transactions that indicate exploitation of a missing-authorization flaw (CWE-862).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20535
author: SOC Threat Intelligence
date: 2026/01/01
logsource:
  product: android
  service: auditd
detection:
  selection_aidl:
    type: 'binder'
    msg|contains:
      - 'transaction'
      - 'aidl'
  selection_priv_escalation:
    type: 'selinux'
    msg|contains:
      - 'avc: denied'
      - 'permissive=0'
    scontext|contains: 'untrusted_app'
    tcontext|contains: 'system_app'
  condition: selection_aidl and selection_priv_escalation
fields:
  - type
  - msg
  - scontext
  - tcontext
  - pid
  - uid
falsepositives:
  - Legitimate system-component Binder traffic
  - SELinux denials during boot or OTA processing
level: high

YARA Rule

rule Android_AIDL_PrivEsc_CVE_2026_20535
{
    meta:
        description = "Detects binaries or payloads attempting to abuse AIDL/Binder interfaces for local privilege escalation via missing authorization (CVE-2026-20535)"
        author = "SOC Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20535"
        tlp = "WHITE"
    strings:
        $aidl_if = "android/os/IInterface" ascii
        $binder = "android.os.Binder" ascii
        $transact = "transact" ascii
        $perm = "checkCallingPermission" ascii nocase
        $svc = "getSystemService" ascii
    condition:
        uint32(0) == 0x464c457f and (2 of ($aidl_if, $binder, $svc)) and 1 of ($transact, $perm)
}

Suricata IDS Rule

Network detection is of limited value here because the vulnerability is purely local (AIDL/Binder is an in-device IPC mechanism, not IP networking). The rule below only fires if a device-side shim exports captured Binder metadata to a network sensor. It is provided for completeness and must be adapted to the customer's transport.

alert tcp any any -> any any (msg:"LOCAL-ONLY INDICATOR - Android AIDL privilege escalation attempt observed in exported Binder telemetry (CVE-2026-20535)"; flow:to_server,established; content:"CVE-2026-20535"; sid:10020535; rev:1; metadata:created_at 2026_01_01, confidence Low, cve CVE-2026-20535;)

Elastic Detection

sequence by host.id with maxspan=30s
  [process where event.category == "process" and process.name in ("app_process", "system_server", "mediaserver", "surfaceflinger")]
  [any where event.category == "audit" and event.action in ("binder_transaction", "privilege_escalation") and
       event.outcome == "success" and
       user.id != "0" and
       process.thread.name : "Binder*"]

Splunk SPL Query

index=android sourcetype=android:binder OR sourcetype=android:audit
(type="binder" OR type="selinux")
(msg="*aidl*" OR msg="*transaction*" OR msg="*avc: denied*")
| search (scontext="*untrusted_app*" AND tcontext="*system_app*")
| eval risk="CVE-2026-20535 possible AIDL privilege escalation"
| stats count min(_time) as firstSeen max(_time) as lastSeen by host, pid, uid, scontext, tcontext, risk
| where count > 0
| convert ctime(firstSeen) ctime(lastSeen)

Wazuh OSSEC Rule

<group name="android,cve-2026-20535,">
  <rule id="100535" level="12">
    <decoded_as>json</decoded_as>
    <field name="type">binder</field>
    <field name="msg">\.*(aidl|transaction)\.*</field>
    <description>CVE-2026-20535: Suspicious Android AIDL/Binder transaction - possible missing-authorization privilege escalation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
  <rule id="100536" level="12">
    <decoded_as>json</decoded_as>
    <field name="type">selinux</field>
    <field name="msg">avc: denied</field>
    <field name="scontext">.*untrusted_app.*</field>
    <field name="tcontext">.*system_app.*</field>
    <description>CVE-2026-20535: SELinux denial indicative of AIDL privilege escalation attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Because the flaw requires local code execution and a pre-existing System-privilege foothold, limiting the entry conditions materially reduces risk: enforce strict policy against untrusted application installation (no data: sources, no sideloading on managed fleets), maintain SELinux enforcing mode, and ensure "Developer options"/root access is disabled on managed devices, since a root-anchored process trivially satisfies the System-privilege precondition. Where MDM policy allows, restrict which applications may be granted the permissions adjacent to the affected subsystem.

2. Patch/upgrade steps. No vendor fix, workaround, or affected-version range is published in the provided data. The only patch identifier is ALPS11185216 (with issue ID MSV-9039); platform patch integrators and device OEMs must track the pending Android security bulletin and apply the build containing that patch ID. Until a bulletin is published, treat all unpatched builds that expose the AIDL service as potentially vulnerable and prioritise the vendor's next available security update if the patch ID appears in its fixed list. Validate after deployment by confirming the reported build fingerprint corresponds to a release that includes ALPS11185216.

3. Long-term hardening. Defense-in-depth against this class of IPC bug: require explicit, per-transaction permission checks in all AIDL implementations (never rely on interface discoverability as authorization), enforce the principle of least privilege for every system service and expose operations through the narrowest permission that satisfies the use case, validate caller identity (UID/PID) rather than assumed trust, and fuzz the full Binder transaction space of privileged services on each Android release train. Maintain local code-execution mitigations (SELinux enforcing, verified boot, strict seccomp) as compensating controls because any missing-check flaw in a privileged AIDL interface can be reached by anything with code execution.

References

1. NVD entry — https://nvd.nist.gov/vuln/detail/CVE-2026-20535
2. CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK T1068 — Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
4. Android platform security bulletin index (pending entry for patch ALPS11185216 / issue MSV-9039) — https://source.android.com/docs/security/bulletin
5. Android AIDL documentation — https://developer.android.com/develop/background-work/services/aidl

No threat-actor campaign, exploit-in-the-wild evidence, public PoC, EPSS score, or CISA KEV listing is associated with this CVE in the data provided.