CVE-2026-0634

High

Published: 02 April 2026

Published

02 April 2026

Modified

03 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0006 19.2th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0634 is a high-severity Argument Injection (CWE-88) vulnerability in Tecno (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates command injection (CWE-88) in AssistFeedbackService by requiring validation of inputs from local apps to prevent arbitrary code execution.

SI-2 Flaw Remediation good match

prevent

Addresses the specific CVE by identifying, patching, and deploying fixes for the command injection flaw as referenced in TECNO's security updates.

AC-6 Least Privilege partial match

prevent

Limits damage from privilege escalation to system user by enforcing least privilege on processes like AssistFeedbackService.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Direct local command injection enables exploitation for privilege escalation to system-level code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Code execution in AssistFeedbackService of TECNO Pova7 Pro 5G on Android allows local apps to execute arbitrary code as system via command injection.

Deeper analysisAI

CVE-2026-0634 is a code execution vulnerability in the AssistFeedbackService component of the TECNO Pova7 Pro 5G running Android. It stems from a command injection flaw (CWE-88) that enables local apps to execute arbitrary code with system-level privileges. The vulnerability was published on 2026-04-02 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.

An attacker with local access and low privileges, such as a malicious app installed on the device, can exploit this vulnerability. Exploitation requires low complexity and no user interaction, allowing the attacker to inject commands into AssistFeedbackService and gain arbitrary code execution as the system user. This escalates privileges, potentially enabling full device compromise, data theft, or persistence mechanisms.

Mitigation details are referenced in TECNO's security updates advisory at https://security.tecno.com/SRC/securityUpdates. Security practitioners should consult this page for patch availability and deployment guidance specific to the TECNO Pova7 Pro 5G.