CVE-2026-0095
High
Published: 01 June 2026
Published
01 June 2026
Modified
03 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1
8.0
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.0011
1.4th percentile
Risk Priority
16
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-0095 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Google Android. Its CVSS base score is 8.0 (High).
Operationally, ranked at the 1.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-33805
Vulnerability details
In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…
more
is not needed for exploitation.
- CWE(s)
Related Threats
CVEs Like This One
CVE-2026-0028Same product: Google Android
CVE-2024-34733Same product: Google Android
CVE-2026-0031Same product: Google Android
CVE-2025-48595Same product: Google Android
CVE-2026-0013Same product: Google Android
CVE-2018-9373Same product: Google Android
CVE-2026-0006Same product: Google Android
CVE-2025-36911Same product: Google Android
CVE-2024-49732Same product: Google Android
CVE-2026-28577Same product: Google Android
Affected Assets
google
android
14.0, 15.0, 16.0
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.