CVE-2026-0031
Published: 02 March 2026
Summary
CVE-2026-0031 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0031 is a vulnerability involving an out-of-bounds write due to an integer overflow (CWE-190) in multiple functions within mem_protect.c of the Android kernel's common branch. It affects Android devices running vulnerable kernel versions, with the issue publicly disclosed on March 2, 2026. The flaw carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
A local attacker can exploit this vulnerability to achieve escalation of privilege without requiring additional execution privileges or user interaction. The attack requires only local access to the device, with low complexity, allowing an unprivileged process to potentially overwrite memory outside intended bounds and gain elevated permissions on the system.
Android's March 2026 security bulletin at source.android.com/docs/security/bulletin/2026/2026-03-01 details the issue and recommends applying upstream kernel patches, including commits such as 986614312222d4b3bdcf16840cdb4abdaed8a42d, aff2255dbe38dc7c57bac8d3ba9feed989289b20, and f3a4b4d4a1fe2aface7de74ac257b8705b6de472 available in the kernel/common repository. Device vendors are advised to integrate these fixes into their kernel builds for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9245
Vulnerability details
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local kernel memory corruption (integer overflow leading to out-of-bounds write) enables privilege escalation without additional privileges or user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the integer overflow vulnerability in the Android kernel via patching as detailed in the security bulletin.
Implements memory protection mechanisms that prevent out-of-bounds writes and unauthorized memory manipulation exploited by this kernel flaw.
Requires validation of inputs to kernel functions in mem_protect.c to mitigate integer overflows leading to out-of-bounds writes.