CVE-2026-0114
Published: 10 March 2026
Summary
CVE-2026-0114 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0114 is a vulnerability in the Modem component of Android systems, involving an out-of-bounds write due to an incorrect bounds check, classified under CWE-787. Published on 2026-03-10, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity. The issue affects Android devices, with specific details covered in general and Pixel-focused security bulletins.
Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction. Successful exploitation enables remote code execution, granting high-impact access to confidentiality, integrity, and availability on the targeted device.
Android security advisories at https://source.android.com/docs/security/bulletin/2026/2026-03-01 and https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 provide details on patches and mitigation for affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10840
Vulnerability details
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-0114 enables unauthenticated remote code execution by exploiting an out-of-bounds write in the public-facing Android Modem component over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring timely identification, reporting, and remediation of the out-of-bounds write flaw in the Android Modem component.
Mandates validation of information inputs to the Modem, preventing the out-of-bounds write caused by the incorrect bounds check on network data.
Implements memory safeguards such as non-executable regions and randomization to mitigate remote code execution from the Modem's out-of-bounds write vulnerability.