A critical vulnerability in the Android IDrmManagerService enables unauthenticated local attackers to achieve full privilege escalation.

The vulnerability exists within the IDrmManagerService.cpp file due to a missing bounds check that results in an out of bounds write. This flaw permits an attacker to escalate privileges locally without requiring user interaction or additional execution permissions.

The ability for a local attacker to escalate privileges to the system level poses a severe risk to device integrity and user data confidentiality. Given the CVSS score of 8.4, this vulnerability represents a high-severity threat that could allow malicious actors to bypass security controls and gain full administrative control over affected Android devices.

Immediate Action: Apply the March 2026 Android security updates provided by Google as soon as they become available for your specific device model.

Proactive Monitoring: Review system logs for unusual process activity or attempts to interact with DRM services that may indicate exploitation.

Compensating Controls: Ensure that all installed applications are sourced from trusted app stores and maintain strict device management policies to limit the potential for unauthorized local access.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

This vulnerability presents a significant security risk for Android users by allowing local attackers to bypass standard privilege restrictions. Security teams should prioritize the deployment of the March 2026 security patch across all managed mobile fleets to mitigate the risk of privilege escalation and unauthorized system access.