CVE-2026-0035
Published: 02 March 2026
Summary
CVE-2026-0035 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-0035 is a logic error in the createRequest function of MediaProvider.java within Android, allowing an app to gain read/write access to non-existing files. This vulnerability enables local escalation of privilege without requiring additional execution privileges or user interaction. It is associated with CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write), and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A local attacker, such as a malicious app running on the device with no special privileges, can exploit this issue due to its low attack complexity and lack of need for user interaction. Exploitation leads to arbitrary read/write access on non-existing files, resulting in escalation of privilege and high impacts to confidentiality, integrity, and availability.
The Android security bulletin provides details on patches and mitigation at https://source.android.com/docs/security/bulletin/2026/2026-03-01.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9248
Vulnerability details
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges…
more
needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local EoP via logic error/out-of-bounds access in Android MediaProvider directly enables T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access to files and resources, directly countering the logic error in MediaProvider that allows unauthorized read/write access to non-existing files.
Validates inputs to the createRequest function, preventing malformed requests that trigger the out-of-bounds read/write logic error leading to privilege escalation.
Requires timely identification, reporting, and patching of the specific logic flaw in MediaProvider.java to eliminate the vulnerability.