CVE-2026-0028
Published: 02 March 2026
Summary
CVE-2026-0028 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the integer overflow vulnerability in __pkvm_host_share_guest by requiring timely application of the available upstream kernel patches.
Implements memory safeguards such as address space layout randomization and stack canaries to mitigate exploitation of the out-of-bounds write resulting from the integer overflow.
Enforces validation of inputs to kernel functions to prevent integer overflows triggered by untrusted local inputs leading to the out-of-bounds write.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel integer overflow enabling local privilege escalation via out-of-bounds write.
NVD Description
In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2026-0028 is an integer overflow vulnerability (CWE-190) in the Android kernel, specifically within the __pkvm_host_share_guest function of mem_protect.c. This flaw enables an out-of-bounds write and affects the kernel/common codebase. Published on 2026-03-02, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A local attacker requires no additional execution privileges (PR:N) to exploit this vulnerability, which has low attack complexity (AC:L) and needs no user interaction (UI:N). Successful exploitation allows local escalation of privilege, granting high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H).
The Android Security Bulletin for 2026-03-01 details mitigations at https://source.android.com/docs/security/bulletin/2026/2026-03-01. Upstream patches are available in kernel/common commits at https://android.googlesource.com/kernel/common/+/986614312222d4b3bdcf16840cdb4abdaed8a42d, https://android.googlesource.com/kernel/common/+/aff2255dbe38dc7c57bac8d3ba9feed989289b20, and https://android.googlesource.com/kernel/common/+/f3a4b4d4a1fe2aface7de74ac257b8705b6de472.
Details
- CWE(s)