CVE-2026-0032
Published: 02 March 2026
Summary
CVE-2026-0032 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds write logic error in mem_protect.c by requiring timely application of available upstream kernel patches.
Implements memory protection mechanisms that prevent unauthorized out-of-bounds writes and memory modifications exploited in this kernel vulnerability.
Limits the scope and impact of local privilege escalation by enforcing least privilege on processes interacting with vulnerable kernel functions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local kernel memory corruption vulnerability enabling privilege escalation from low-privileged context without user interaction.
NVD Description
In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2026-0032 is a high-severity vulnerability (CVSS 7.8) involving an out-of-bounds write due to a logic error in multiple functions within mem_protect.c of the Android kernel common codebase. This flaw, tied to CWE-787 (Out-of-bounds Write) and CWE-269 (Improper Privilege Management), was publicly disclosed on March 2, 2026. It affects Android devices running vulnerable kernel versions, potentially exposing systems to local privilege escalation without requiring additional execution privileges or user interaction.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction (UI:N), achieving high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) through privilege escalation. The unchanged scope (S:U) indicates the exploit remains within the affected component, but successful exploitation grants elevated access on the device.
Mitigation is available via upstream kernel patches, including commits 048aebb861d2f3ed4d260a4c9f4e72a43cae9b1e and 33eb6bde43d03bd826214bbb390de62ca19621b9 in the Android kernel common repository. Vendors should reference the Android Security Bulletin for March 2026 at source.android.com/docs/security/bulletin/2026/2026-03-01 for device-specific patch details and deployment guidance.
Details
- CWE(s)