Cyber Resilience

CVE-2026-0634

High

Published: 02 April 2026

Published
02 April 2026
Modified
03 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 22.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0634 is a high-severity Argument Injection (CWE-88) vulnerability in Tecno (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-0634 is a code execution vulnerability in the AssistFeedbackService component of the TECNO Pova7 Pro 5G running Android. It stems from a command injection flaw (CWE-88) that enables local apps to execute arbitrary code with system-level privileges. The vulnerability was published on 2026-04-02 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.

An attacker with local access and low privileges, such as a malicious app installed on the device, can exploit this vulnerability. Exploitation requires low complexity and no user interaction, allowing the attacker to inject commands into AssistFeedbackService and gain arbitrary code execution as the system user. This escalates privileges, potentially enabling full device compromise, data theft, or persistence mechanisms.

Mitigation details are referenced in TECNO's security updates advisory at https://security.tecno.com/SRC/securityUpdates. Security practitioners should consult this page for patch availability and deployment guidance specific to the TECNO Pova7 Pro 5G.

EU & UK References

Vulnerability details

Code execution in AssistFeedbackService of TECNO Pova7 Pro 5G on Android allows local apps to execute arbitrary code as system via command injection.

CWE(s)
CWE-88

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Direct local command injection enables exploitation for privilege escalation to system-level code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-4145Shared CWE-88
CVE-2025-15316Shared CWE-88
CVE-2026-41013Shared CWE-88
CVE-2025-15315Shared CWE-88
CVE-2025-0065Shared CWE-88
CVE-2025-12556Shared CWE-88
CVE-2026-1715Shared CWE-88
CVE-2026-24061Shared CWE-88
CVE-2026-31230Shared CWE-88
CVE-2026-40113Shared CWE-88

Affected Assets

Tecno
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates command injection (CWE-88) in AssistFeedbackService by requiring validation of inputs from local apps to prevent arbitrary code execution.

SI-2 Flaw Remediation good match
prevent

Addresses the specific CVE by identifying, patching, and deploying fixes for the command injection flaw as referenced in TECNO's security updates.

AC-6 Least Privilege partial match
prevent

Limits damage from privilege escalation to system user by enforcing least privilege on processes like AssistFeedbackService.

References