PT-2026-4698 · Unknown · Biometricservice

Publicado 2026-01-25 · Atualizado 2026-03-02 · CVE-2026-0017

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions versions prior to the fixed version (affected versions not specified)

Description A logic error in the code within BiometricService.java’s onChange function may allow enabling fingerprint unlock. This could result in local privilege escalation without requiring additional execution privileges. Exploitation does not require user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-285

CWE-693

Identificadores relacionados

ASB-A-444673089

CVE-2026-0017

Produtos afetados

Biometricservice

Referências · 8

• https://source.android.com/docs/security/bulletin/2026/2026-03-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-0017 · Nota de Segurança
• https://twitter.com/GrapheneOS/status/2015510661019644403 · Publicação no Twitter
• https://android.googlesource.com/platform/frameworks/base/+/cea235f00865ff73344f1efa9494e47beecc3fd5 · Nota
• https://osv.dev/vulnerability/CVE-2026-0017 · Aviso do Fabricante
• https://android.googlesource.com/platform/packages/apps/Settings/+/7d8fbee887fc9577337c2a80513ae4399bf60111 · Nota
• https://osv.dev/vulnerability/ASB-A-444673089 · Aviso do Fabricante
• https://source.android.com/security/bulletin/2026-03-01 · Nota