Android — PoC Archivehttps://poc.intelseclab.com/tags/android/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-06_cve-2025-54957-dolby-decoder-oob-write/Critical severity (CVSS 9.8) — binary · CVE-2025-54957. Status: Weaponized. Affects: Dolby Digital Plus (DDPlus) Unified Decoder — bundled in Android media stack, iOS/macOS CoreAudio-adjacent decoders, and ChromeOS. Tags: dolby, ddplus, ac-3, ec-3, audio-codec, out-of-bounds-write, integer-overflow, zero-click, android, ios, macos, heap-corruption.binaryCriticaldolbyddplusac-3ec-3audio-codecout-of-bounds-writeinteger-overflowzero-clickandroidiosmacosheap-corruptionSamsung SveService Native Out-of-Bounds Write (CVE-2026-21018)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21018-samsung-sveservice-oob-write-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21018-samsung-sveservice-oob-write-lpe/High severity — binary · CVE-2026-21018 (Samsung SVE-2026-0478, SMR May 2026). Status: PoC. Affects: Samsung SveService (com.sec.sve) system service and its libsvejni.so native library. Tags: android, samsung, binder, native, out-of-bounds-write, jni, lpe, memcpy, memset.binaryHighandroidsamsungbindernativeout-of-bounds-writejnilpememcpymemsetSamsung Android AT-Command Filter Bypass to system_server Code Execution (CVE-2026-20980)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20980-samsung-android-at-command-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20980-samsung-android-at-command-lpe/Critical severity — binary · CVE-2026-20980 (chained with CVE-2026-20981 and CVE-2026-20982). Status: PoC. Affects: Samsung Android AT-command distribution stack (at_distributor / libpacm_client.so, FacAtFunction system app, ShortcutService). Tags: android, samsung, at-command, privilege-escalation, usb, system-server, exploit-chain, java, apk.binaryCriticalandroidsamsungat-commandprivilege-escalationusbsystem-serverexploit-chainjavaapkLinux Kernel Futex-PI rtmutex remove_waiter() Use-After-Free (CVE-2026-43499)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/High severity (CVSS 7.8) — binary · CVE-2026-43499. Status: PoC. Affects: Linux kernel — kernel/locking/rtmutex.c, futex-PI subsystem (futex_requeue() / rt_mutex_start_proxy_lock()). Tags: linux-kernel, android, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, kernel-panic, ndk.binaryHighlinux-kernelandroiduse-after-freefutexrtmutexpriority-inheritancelpelocalkernel-panicndklibopenapv / Android APV Codec Zero-Click Heap Buffer Overflow (CVE-2026-0006)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0006-openapv-heap-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0006-openapv-heap-overflow/Critical severity (CVSS 9.8) — binary · CVE-2026-0006. Status: PoC. Affects: libopenapv (Samsung APV — Advanced Professional Video — codec), integrated into Android 16 as a Mainline module (mediaswcodec / C2SoftApvDec). Tags: android, libopenapv, apv-codec, heap-overflow, zero-click, media-framework, mediaswcodec, mainline-module.binaryCriticalandroidlibopenapvapv-codecheap-overflowzero-clickmedia-frameworkmediaswcodecmainline-moduleEcoOnline EHS Android App — Deep Link Validation Bypass to WebView Open Redirect (CVE-2026-26897)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26897-ecoonline-deeplink-redirect/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26897-ecoonline-deeplink-redirect/Medium severity (CVSS 6.3) — web · CVE-2026-26897. Status: PoC. Affects: EcoOnline EHS for Android (com.airsweb.v10). Tags: android, deep-link, webview, open-redirect, phishing, cwe-939, mobile-security, ecoonline.webMediumandroiddeep-linkwebviewopen-redirectphishingcwe-939mobile-securityecoonlineAndroid ActivityManagerService dumpBitmapsProto() Missing Permission Check (CVE-2026-0047)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0047-activitymanager-bitmap-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-0047-activitymanager-bitmap-leak/Critical severity (CVSS 8.4) — binary · CVE-2026-0047. Status: Weaponized. Affects: Android system_server ActivityManagerService.dumpBitmapsProto(). Tags: android, activitymanagerservice, binder, missing-permission-check, information-disclosure, zero-permission, baklava, bitmap-theft.binaryCriticalandroidactivitymanagerservicebindermissing-permission-checkinformation-disclosurezero-permissionbaklavabitmap-theftBlueDucky — Unauthenticated Peering Leading to Code Execution (CVE-2023-45866)https://poc.intelseclab.com/pocs/network/2026-05-15_blueducky-cve-2023-45866/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-15_blueducky-cve-2023-45866/High severity (CVSS 8.8) — network · CVE-2023-45866. Status: Weaponized. Affects: Bluetooth HID host implementations vulnerable to CVE-2023-45866. Tags: Bluetooth, HID, keystroke-injection, unauthenticated, Android, Linux.networkHighBluetoothHIDkeystroke-injectionunauthenticatedAndroidLinux