CVE-2026-0124
Published: 10 March 2026
Summary
CVE-2026-0124 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-0124 is an out-of-bounds write vulnerability stemming from a missing bounds check, classified under CWE-787. It affects Google Pixel devices running Android, as detailed in the associated security bulletin. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-10.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity and no user interaction required. No additional execution privileges are needed beyond the attacker's existing access. Successful exploitation enables local escalation of privilege, resulting in high impacts to confidentiality, integrity, and availability.
The Pixel security bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 addresses mitigation and available patches for affected devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10858
Vulnerability details
There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables local privilege escalation on Android device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the out-of-bounds write flaw via timely patching as provided in the Pixel security bulletin.
Implements memory safeguards such as DEP and ASLR that prevent exploitation of the missing bounds check leading to unauthorized code execution and privilege escalation.
Mandates validation of information inputs including bounds checks, directly countering the missing bounds check responsible for the out-of-bounds write vulnerability.