TLPE

This is a PoC and a writeup for CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 systemserver with no extra user interaction. We also show here that systemserver code execution...

Exploit for CVE-2026-49881

This is a PoC and a writeup for CVE-2026-49881, a logic issue in...

CVE-2026-49881

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49881

A logic error in InCallController.java within the Android 17 Telecom service allows an unprivileged app to achieve arbitrary code execution as the UID 1000 system_server user without user interaction. The vulnerability occurs because serviceClassExists uses createPackageContext with CONTEXT_IGNOR...

CVE-2026-49881

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...