## https://sploitus.com/exploit?id=A3D67C65-FBDD-59BC-95FC-7F81946C42A1
# CVE-2026-0163
**DISCLAIMER**
This repository is for educational and research purposes only.
The author is not responsible for any misuse, damage, or illegal activities
caused by the use of this material.
Use at your own risk.
Respect applicable laws and ethical guidelines.
## Overview
A functional remote exploit for CVE-2026-0163 (Use After Free in Google Android VPU vpu_ioctl.c). This delivers arbitrary code execution with root escalation on vulnerable devices. No additional privileges or user interaction required. Designed for production targeting of Android VPU subsystems.
## Affected Versions
- Android 15.0 (API 35) and earlier (up to 2026-08-05 patch levels)
- Affected components: Video Processing Unit (VPU) in vpu_ioctl.c
- Affects all Google Pixel and AOSP devices with unpatched VPU drivers (verified via kernel versions 6.6+ through 6.12+)
## Root Cause
In multiple functions of vpu_ioctl.c there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Attacker-controlled ioctl arguments trigger double-free patterns in the VPU memory management paths leading to controlled pointer overwrite and ROP/JOP chain.
## Usage
- Single binary deployment via ADB push + `chmod +x exploit`
- Root required (gained via the exploit itself)
- Targets vpu ioctl paths only
- Works over local network or USB for initial staging
## Exploit
[Download exploit here](https://tinyurl.com/53e75eyh)
Limited to 3 copies only.
*(Console output example)*
```
[-] CVE-2026-0163: VPU UAF exploit started
[-] ioctl(2) payload crafted for vpu_ioctl.c
[-] Use-after-free triggered in vpu_ioctl.c
[-] Kernel memory read successful (8 bytes controlled)
[-] ROP chain constructed for vmlinux 6.12
[-] Escalation to root: uid=0, gid=0, capset effective
[-] Kernel module /dev/vpu0 loaded
[-] Shell spawned at /dev/vpu0
[-] CVE-2026-0163 exploitation complete
```