CVE-2026-0038
Published: 02 March 2026
Summary
CVE-2026-0038 is a high-severity an unspecified weakness vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0038 is a high-severity vulnerability (CVSS 8.4) affecting the Android kernel, specifically multiple functions in the mem_protect.c file. It stems from a logic error that enables arbitrary code execution, potentially leading to local escalation of privilege. No additional execution privileges are required beyond local access, and user interaction is not needed for exploitation.
A local attacker can exploit this vulnerability with low complexity due to its attack vector (AV:L/AC:L/PR:N/UI:N). Successful exploitation grants high-impact confidentiality, integrity, and availability (C:H/I:H/A:H) in an unchanged security scope (S:U), allowing the attacker to elevate privileges, such as from a standard user to kernel-level access.
Mitigation is addressed through patches in the Android kernel common repository, including commits at https://android.googlesource.com/kernel/common/+/1bf8033b56a45165602f8116e0a0d2e767f1e8ae, https://android.googlesource.com/kernel/common/+/513ea99ae008b81dd266bf6e361627c058ddde41, https://android.googlesource.com/kernel/common/+/652b7b6bf9a62cc12c3a071bab4e92314f046739, https://android.googlesource.com/kernel/common/+/7e1d15d29b7fe0f858926a8bcaf929b75db9e52a, and https://android.googlesource.com/kernel/common/+/b23a5bfa1fb8f9525e21f095a87486a2bd856321. Security practitioners should ensure affected systems apply these upstream fixes or equivalent vendor updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9250
Vulnerability details
In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
more
needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel logic error enabling local arbitrary code execution for privilege escalation to kernel level (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of the specific logic error in mem_protect.c through kernel patches to prevent arbitrary code execution and local privilege escalation.
Implements robust memory protection mechanisms that directly address and mitigate the logic error in mem_protect.c enabling arbitrary code execution.
Enforces process isolation to limit the impact of local privilege escalation resulting from the kernel memory protection logic error.