CVE Intelligence
Analysis AI-assisted

CVE-2026-0106: Google Android vpu_ioctl Missing Bounds Check Enables Arbitrary Address mmap and Local Privilege Escalation

CVE-2026-0106 is a missing bounds check in the vpu_mmap routine of vpu_ioctl in Google Android, which the CNA says can allow an arbitrary address mmap. The CNA describes possible local privilege escalation without additional execution privileges and without user interaction, and reports a CVSS 3.1 base score of 9.3 (critical). No confirmed exploitation appears in the sources consulted, and the record does not list affected or fixed version ranges.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-0106 is described by the CNA as a missing bounds check in the vpu_mmap routine of the vpu_ioctl component in Google Android. The record states that this could allow an arbitrary address mmap and lead to local escalation of privilege. The only vendor reference in the record is a Pixel security bulletin dated 2026-02-01.

Impact

  • The CNA reports a CVSS 3.1 base score of 9.3 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, rated critical.
  • The vector indicates local attack vector, no privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity and availability.
  • The described weakness is a privilege escalation risk: a local process could potentially gain privileges it should not have.

Affected products and versions

  • Product: Google Android.
  • Versions: the source does not specify affected versions, so no version range can be confirmed from the record.
  • The record lists no fixed versions. This does not mean no fix exists; it means the record does not provide that information.

Exploitation status

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the record. No confirmed exploitation appears in the sources consulted. No EPSS or SSVC data is available in the record.

Remediation and mitigation

  • Check the vendor advisory for the Android and Pixel security updates that address this issue, and apply the latest available security patch level to affected devices.
  • Prioritize devices with local or shared-user exposure, since the vector indicates a local attack path.
  • Limit installation of untrusted applications and restrict local access on managed fleets until patches are verified.
  • Track the vendor advisory for updates, since the record does not confirm which builds contain the fix.

Detection guidance

  • Use mobile device management or inventory tools to report patch levels and identify devices that have not received the relevant security update.
  • Monitor for unexpected privilege changes or abnormal local process behavior on endpoints, as a general defensive measure.
  • Keep logs of device security posture and update status to support incident review.

Limitations of the available information

  • No affected or fixed version ranges are given beyond the product name.
  • The record does not confirm which Android or Pixel builds include the fix, or whether the referenced bulletin covers this CVE in detail.
  • The record has no title, EPSS, SSVC or KEV exploitation details beyond the KEV listing being false.
  • The sources consulted were limited to the record and its listed pages; no additional advisory content was verified.

Frequently asked questions

What is CVE-2026-0106?

It is a missing bounds check in the vpu_mmap routine of vpu_ioctl in Google Android, which the CNA says could allow an arbitrary address mmap and local privilege escalation.

Is CVE-2026-0106 known to be actively exploited?

No. The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which Android versions are affected?

The source does not specify affected versions, and the record lists no fixed versions. Consult the vendor advisory and apply the latest security updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.