AGL app-framework-binder Privilege Escalation (CVE-2026-37525)

The National Vulnerability Database has detailed CVE-2026-37525, a high-severity privilege escalation vulnerability in AGL app-framework-binder (afb-daemon) through v19.90.0. This flaw resides within the supervision Do command, specifically in the on_supervision_call function in src/afb-supervision.c. The core issue, as described by the National Vulnerability Database, is that the function explicitly nullifies request credentials by calling afb_context_change_cred(&xreq->context, NULL) before dispatching an attacker-controlled API call.

This nullification means that any registered API can be executed with a NULL credential context. According to the National Vulnerability Database, APIs that rely on context->credentials for authorization decisions may fail open, effectively granting an attacker elevated privileges. The vulnerability was introduced in a commit from February 14, 2018, indicating a long-standing weakness in the framework. The CVSSv3.1 score is 7.8 (HIGH), with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, highlighting significant impacts on confidentiality, integrity, and availability from a low-privilege local attacker.

While specific affected products beyond the AGL app-framework-binder itself are not enumerated, any system integrating this component is potentially at risk. The attacker’s calculus here is straightforward: gain initial low-level access, then exploit this vulnerability to escalate privileges and take control of the underlying system. This is a critical building block for broader compromise.