CVE-2026-0116
Published: 10 March 2026
Description
In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the out-of-bounds write vulnerability by requiring timely installation of patches from Android security bulletins.
Implements memory protection mechanisms like non-executable memory and ASLR to prevent remote code execution from the out-of-bounds write.
Requires validation of buffer parameters and indices in functions like __mfc_handle_released_buf to address missing bounds checks.
Security SummaryAI
CVE-2026-0116 is a vulnerability involving an out-of-bounds write due to a missing bounds check in the __mfc_handle_released_buf function within mfc_core_isr.c. This issue affects Android software components, as documented in the Android Security Bulletin and Pixel Update Bulletin for March 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-787 (Out-of-bounds Write).
The vulnerability enables remote code execution without requiring additional execution privileges or user interaction. Attackers can exploit it remotely over the network (AV:N) with low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), potentially compromising confidentiality, integrity, and availability (C:H/I:H/A:H) in an unchanged scope (S:U).
Android advisories at https://source.android.com/docs/security/bulletin/2026/2026-03-01 and https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 detail patches addressing this vulnerability. Security practitioners should prioritize applying these updates to affected Android and Pixel devices to mitigate exploitation risks.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote code execution over the network with no privileges or user interaction required, directly facilitating exploitation of a public-facing application.