CVE-2026-0100: In Load of LoadedArsc

Synopsis

This is a heap buffer overflow in Android's resource loading code, specifically in the Load function of LoadedArsc.cpp. An attacker with a low-privilege local account can trigger an out-of-bounds write without any user interaction, exploiting the flaw entirely from a shell or process already running on the device. Successful exploitation gives the attacker full read, write, and execution control over the affected process, enabling local privilege escalation. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no elevated or administrative credentials are needed beyond basic shell access.

• Victim interactionNot required

  No user action, click, or social-engineering step is needed; the exploit runs without any interaction from another user on the device.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout guesswork, or environmental prerequisites.

Blast Radius

• Reads any data accessible to the compromised process, including stored credentials, session tokens, and application files.
• Overwrites memory and persisted data within the process's reach, enabling tampering with application state or stored records.
• Escalates privileges beyond the initial low-privilege account, potentially gaining control over higher-privilege system processes or components.
• Can destabilize or crash the affected service if the out-of-bounds write corrupts critical runtime structures.