CVE-2026-0634

Description

Code execution in AssistFeedbackService of TECNO Pova7 Pro 5G on Android allows local apps to execute arbitrary code as system via command injection.

PUBLISHED Reserved 2026-01-06 | Published 2026-04-02 | Updated 2026-04-02 | Assigner TECNOMobile

Problem types

CWE-88 Improper neutralization of argument delimiters in a command ('argument injection')

Product status

References

security.tecno.com/SRC/securityUpdates

cve.org (CVE-2026-0634)

nvd.nist.gov (CVE-2026-0634)

Download JSON