CVE-2026-0113
Published: 10 March 2026
Summary
CVE-2026-0113 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-0113 is a vulnerability involving an out-of-bounds write due to an incorrect bounds check in the ns_GetUserData function of ns_SmscbUtilities.c. This issue affects Android devices, as documented in the associated security bulletins.
A remote attacker requires no privileges or user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation leads to escalation of privilege, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting high impacts on confidentiality, integrity, and availability. The root cause is classified under CWE-787 (Out-of-bounds Write).
The Android Security Bulletin for 2026-03-01 at https://source.android.com/docs/security/bulletin/2026/2026-03-01 and the Pixel-specific bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 provide details on patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10839
Vulnerability details
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote network exploitation with no privileges enables T1190 (Exploit Public-Facing Application); results in privilege escalation matching T1068 (Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs including bounds checks, directly preventing the out-of-bounds write due to incorrect bounds check in ns_GetUserData.
SI-16 enforces memory protections such as address space layout randomization and stack guards that mitigate exploitation of out-of-bounds writes for privilege escalation.
SI-2 mandates timely identification, testing, and remediation of flaws like this buffer overflow vulnerability via patching as detailed in Android security bulletins.