CVE Intelligence
Analysis AI-assisted

CVE-2026-0110: Google Android Privilege Escalation via Memory Corruption in MM_DATA_IND

CVE-2026-0110 is a memory corruption issue in Google Android, located in MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, that could allow a possible elevation of privilege. The CNA and CISA-ADP both score it 9.8 (critical), and the record describes no user interaction and no additional execution privileges. The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0110 is recorded against Google Android. The description states a possible elevation of privilege caused by memory corruption in MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp. The record assigns CWE-120 (Classic Buffer Overflow).

Impact

The description states that the issue could lead to remote escalation of privilege, with no additional execution privileges needed and no user interaction. The CVSS score of 9.8 (critical) from the CNA and CISA-ADP matches a network-reachable, low-complexity, unprivileged, no-interaction profile, with high impact on confidentiality, integrity and availability according to the vector string in the record.

  • The vector string in the record rates confidentiality, integrity and availability impact as high.
  • The SSVC fields in the record rate exploitation as none, automatable as yes and technical impact as total.

Affected products and versions

  • The record lists Google Android as the affected product.
  • The version entries in the record are generic: 'versions not specified by the source' and a reference to the Android kernel without a version range.
  • No specific affected version strings are available in the record, so no version ranges can be stated.

Exploitation status

The record does not list this CVE in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted. The record reports an EPSS probability of 0.00318 and a percentile of 0.23483.

Remediation and mitigation

  • Review the Android security bulletins referenced in the record and confirm whether your managed devices run a build that includes the relevant fixes.
  • The record lists no fixed versions. The absence of fixed versions in the record does not mean that no fix exists.
  • Prioritize devices with high exposure given the critical score, and enforce updates through your mobile device management policy.

Detection guidance

  • Track device patch levels in your asset or MDM inventory and compare them with the vendor bulletin.
  • Monitor managed devices for unexpected crashes or instability in messaging components, which may be an indicator of memory corruption problems.
  • Keep records of security updates applied to each device group.

Limitations of the available information

  • The record does not specify affected or fixed versions.
  • The record gives no technical detail beyond the description and the component names it contains.
  • The EPSS date in the record is later than the publication date, so treat the EPSS figures as reported values and check current data before relying on them.

Frequently asked questions

Is CVE-2026-0110 being actively exploited?

The record does not list CVE-2026-0110 in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

Which Android versions are affected?

The record does not specify affected version strings, so no version ranges can be stated. Check the Android security bulletins referenced in the record.

What should administrators do now?

Review the referenced Android bulletins, verify patch levels on managed devices, and enforce updates through your device management policy. The record lists no fixed versions.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.