CVE-2026-0073

Android: In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as

Google AndroidOperating systems

CVSS

8.8High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.54%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 25 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published4 May 2026Updated 5 May 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

4 May 2026, 18:00 UTCPublishedCVE List
25 Oct 2026, 19:46 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

umarrehmansiddiqui/CVE-2026-0073: CVE-2026-0073: Android adbd TLS auth bypass PoC. Exploits a logic bug where OpenSSL's EVP_PKEY_cmp() returns -1 on key type mismatch (EC vs RSA), incorrectly evaluating to true and granting access. IncludesGitHub proof-of-concept repositories, 25 Oct 2026Exploit code

Description

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.

Text from CVE List

Affected versions 4

Androidaffected: 16-qpr2CVE List
Androidaffected: 16CVE List
Androidaffected: 15CVE List
Androidaffected: 14CVE List

References 1

source.android.com/docs/security/bulletin/2026/2026-05-01Advisoryvia CVE List