PT-2026-4698 · Unknown · Biometricservice

Published 2026-01-25 · Updated 2026-03-02 · CVE-2026-0017

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions versions prior to the fixed version (affected versions not specified)

Description A logic error in the code within BiometricService.java’s onChange function may allow enabling fingerprint unlock. This could result in local privilege escalation without requiring additional execution privileges. Exploitation does not require user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Protection Mechanism Failure

Weakness Enumeration

CWE-285

CWE-693

Related Identifiers

ASB-A-444673089

CVE-2026-0017

Affected Products

Biometricservice

References · 8

• https://source.android.com/docs/security/bulletin/2026/2026-03-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0017 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0017 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-444673089 · Vendor Advisory
• https://twitter.com/GrapheneOS/status/2015510661019644403 · Twitter Post
• https://android.googlesource.com/platform/frameworks/base/+/cea235f00865ff73344f1efa9494e47beecc3fd5 · Note
• https://android.googlesource.com/platform/packages/apps/Settings/+/7d8fbee887fc9577337c2a80513ae4399bf60111 · Note
• https://source.android.com/security/bulletin/2026-03-01 · Note