CVE-2026-0116
Published: 10 March 2026
Summary
CVE-2026-0116 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0116 is a vulnerability involving an out-of-bounds write due to a missing bounds check in the __mfc_handle_released_buf function within mfc_core_isr.c. This issue affects Android software components, as documented in the Android Security Bulletin and Pixel Update Bulletin for March 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-787 (Out-of-bounds Write).
The vulnerability enables remote code execution without requiring additional execution privileges or user interaction. Attackers can exploit it remotely over the network (AV:N) with low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), potentially compromising confidentiality, integrity, and availability (C:H/I:H/A:H) in an unchanged scope (S:U).
Android advisories at https://source.android.com/docs/security/bulletin/2026/2026-03-01 and https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 detail patches addressing this vulnerability. Security practitioners should prioritize applying these updates to affected Android and Pixel devices to mitigate exploitation risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10842
Vulnerability details
In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote code execution over the network with no privileges or user interaction required, directly facilitating exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the out-of-bounds write vulnerability by requiring timely installation of patches from Android security bulletins.
Implements memory protection mechanisms like non-executable memory and ASLR to prevent remote code execution from the out-of-bounds write.
Requires validation of buffer parameters and indices in functions like __mfc_handle_released_buf to address missing bounds checks.