by Kastro
Paper/Archive/CVE-2026-0110

CVE-2026-0110

Google Android — In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption.

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 24.7.247 × 204.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource
AndroidAndroid kernel–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysource.android.com/docs/security/bulletin/2026/2026-03-01advisorysource.android.com/docs/security/bulletin/pixel/2026/2026-03-01