Cyber Resilience

CVE-2026-0038

High

Published: 02 March 2026

Published
02 March 2026
Modified
06 March 2026
KEV Added
Patch
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0023 13.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-0038 is a high-severity an unspecified weakness vulnerability in Google Android. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-0038 is a high-severity vulnerability (CVSS 8.4) affecting the Android kernel, specifically multiple functions in the mem_protect.c file. It stems from a logic error that enables arbitrary code execution, potentially leading to local escalation of privilege. No additional execution privileges are required beyond local access, and user interaction is not needed for exploitation.

A local attacker can exploit this vulnerability with low complexity due to its attack vector (AV:L/AC:L/PR:N/UI:N). Successful exploitation grants high-impact confidentiality, integrity, and availability (C:H/I:H/A:H) in an unchanged security scope (S:U), allowing the attacker to elevate privileges, such as from a standard user to kernel-level access.

Mitigation is addressed through patches in the Android kernel common repository, including commits at https://android.googlesource.com/kernel/common/+/1bf8033b56a45165602f8116e0a0d2e767f1e8ae, https://android.googlesource.com/kernel/common/+/513ea99ae008b81dd266bf6e361627c058ddde41, https://android.googlesource.com/kernel/common/+/652b7b6bf9a62cc12c3a071bab4e92314f046739, https://android.googlesource.com/kernel/common/+/7e1d15d29b7fe0f858926a8bcaf929b75db9e52a, and https://android.googlesource.com/kernel/common/+/b23a5bfa1fb8f9525e21f095a87486a2bd856321. Security practitioners should ensure affected systems apply these upstream fixes or equivalent vendor updates.

EU & UK References

Vulnerability details

In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…

more

needed for exploitation.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Kernel logic error enabling local arbitrary code execution for privilege escalation to kernel level (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-48646Same product: Google Android
CVE-2024-43077Same product: Google Android
CVE-2026-0106Same product: Google Android
CVE-2024-53840Same product: Google Android
CVE-2025-48574Same product: Google Android
CVE-2024-49732Same product: Google Android
CVE-2025-48619Same product: Google Android
CVE-2024-49742Same product: Google Android
CVE-2026-0035Same product: Google Android
CVE-2024-11624Same product: Google Android

Affected Assets

google
android
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Mandates timely remediation of the specific logic error in mem_protect.c through kernel patches to prevent arbitrary code execution and local privilege escalation.

prevent

Implements robust memory protection mechanisms that directly address and mitigate the logic error in mem_protect.c enabling arbitrary code execution.

prevent

Enforces process isolation to limit the impact of local privilege escalation resulting from the kernel memory protection logic error.

References