by Kastro
Paper/Archive/CVE-2026-0006

CVE-2026-0006

Google Android — In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow.

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.7.507 × 2010.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource
Android16–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysource.android.com/docs/security/bulletin/2026/2026-03-01