CVE-2026-0030
Published: 02 March 2026
Summary
CVE-2026-0030 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely remediation through application of the vendor-provided kernel patches directly eliminates the out-of-bounds write vulnerability in __host_check_page_state_range.
Memory protection mechanisms such as address space layout randomization and data execution prevention mitigate exploitation of the incorrect bounds check leading to out-of-bounds writes.
Monitoring security alerts and advisories from the Android Security Bulletin enables identification of the kernel vulnerability for subsequent patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local kernel out-of-bounds write enabling privilege escalation without privileges or user interaction (T1068).
NVD Description
In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2026-0030 is a vulnerability in the Android kernel's mem_protect.c file, specifically within the __host_check_page_state_range function, where an incorrect bounds check can lead to an out-of-bounds write. This issue, classified under CWE-787 (Out-of-bounds Write), affects the kernel/common codebase used in Android devices. It was published on 2026-03-02 and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker can exploit this vulnerability without requiring additional execution privileges or user interaction. By triggering the flawed bounds check, the attacker can achieve local escalation of privilege, potentially gaining unauthorized access to sensitive data or system resources with high confidentiality, integrity, and availability impacts.
The Android Security Bulletin for March 2026, available at source.android.com/docs/security/bulletin/2026/2026-03-01, documents the vulnerability and recommends applying the provided upstream kernel patches. Mitigation involves updating to the fixed kernel versions, with specific commits referenced at android.googlesource.com/kernel/common, including 986614312222d4b3bdcf16840cdb4abdaed8a42d, aff2255dbe38dc7c57bac8d3ba9feed989289b20, and f3a4b4d4a1fe2aface7de74ac257b8705b6de472.
Details
- CWE(s)