Cyber Posture

CVE-2026-0113

Critical

Published: 10 March 2026

Published
10 March 2026
Modified
11 March 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0023 45.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of information inputs including bounds checks, directly preventing the out-of-bounds write due to incorrect bounds check in ns_GetUserData.

SI-16 Memory Protection good match
prevent

SI-16 enforces memory protections such as address space layout randomization and stack guards that mitigate exploitation of out-of-bounds writes for privilege escalation.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely identification, testing, and remediation of flaws like this buffer overflow vulnerability via patching as detailed in Android security bulletins.

Security SummaryAI

CVE-2026-0113 is a vulnerability involving an out-of-bounds write due to an incorrect bounds check in the ns_GetUserData function of ns_SmscbUtilities.c. This issue affects Android devices, as documented in the associated security bulletins.

A remote attacker requires no privileges or user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation leads to escalation of privilege, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting high impacts on confidentiality, integrity, and availability. The root cause is classified under CWE-787 (Out-of-bounds Write).

The Android Security Bulletin for 2026-03-01 at https://source.android.com/docs/security/bulletin/2026/2026-03-01 and the Pixel-specific bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 provide details on patches and mitigation steps.

Details

CWE(s)
CWE-787

Affected Products

google
android
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Remote network exploitation with no privileges enables T1190 (Exploit Public-Facing Application); results in privilege escalation matching T1068 (Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References