CVE Intelligence
Analysis AI-assisted

CVE-2026-0111: Google Android out-of-bounds write in ns_SmscbUtilities

CVE-2026-0111 is an out-of-bounds write in the ns_GetUserData function of ns_SmscbUtilities.c in Google Android, caused by an incorrect bounds check. The record describes possible remote escalation of privilege without user interaction and reports a CVSS base score of 9.8. CISA KEV does not list the CVE and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

NVD and the CVE Program describe CVE-2026-0111 as an out-of-bounds write in the ns_GetUserData function of ns_SmscbUtilities.c, caused by an incorrect bounds check. The Google Devices CNA published the record and classifies the weakness as CWE-787.

Impact

  • The record describes the possible result as remote escalation of privilege, with no additional execution privileges needed.
  • The record states that user interaction is not needed for exploitation.
  • The CVSS base score of 9.8 is reported by the CNA and by CISA-ADP, and the vector in the record indicates network attack vector, low complexity, no privileges and no user interaction.

Affected products and versions

Exploitation status

  • CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted.
  • The SSVC record shows exploitation as none and automatable as yes, which is an assessment and not evidence of exploitation.
  • The EPSS probability is 0.00318 with a percentile of 0.23483.

Remediation and mitigation

  • The record lists no fixes. Apply the vendor patches described in the Android bulletins linked above as soon as they are available for your devices.
  • Give higher priority to devices that are reachable from untrusted networks, given the network attack vector in the record.
  • Track vendor advisories and confirm the patch level of each device in your inventory.

Detection guidance

  • Maintain an inventory of Android devices and their patch levels to identify those that may be unpatched.
  • Watch for unexplained crashes or instability in network-facing messaging or cell broadcast related components. This is a general indicator and not a confirmed signature for this flaw.

Limitations of the available information

  • The record has no title and no fixed or affected version numbers.
  • The description does not detail the memory layout, the data involved or the conditions needed beyond the stated bounds check error.
  • Affected builds and patch status must be verified against the vendor bulletins.

Frequently asked questions

Is CVE-2026-0111 being exploited in the wild?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC assessment in the record shows exploitation as none.

Which Android versions are affected?

The sources consulted do not specify affected version numbers. Check the Android Security Bulletin and the Pixel Security Bulletin to determine which builds are covered.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.