High · 7.3 CVE-2026-22078 EUVD-2026-40052GHSA-xf9v-h779-xxhr

O+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.

Published Jun 29, 2026 · Updated Jun 29, 2026 · Assigned by OPPO

Description

Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.

Affected products

Vendor	Product	Affected	Fixed
OPPO	O+ Connect	16.0.33	—

References

https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2070415238859333632