CVE Intelligence
Analysis AI-assisted

CVE-2026-0113: Google Android ns_SmscbUtilities out-of-bounds write

CVE-2026-0113 is a critical out-of-bounds write in the ns_GetUserData function of ns_SmscbUtilities.c in Google Android, caused by an incorrect bounds check. The Google CNA describes it as allowing remote escalation of privilege without additional execution privileges and without user interaction. No confirmed exploitation appears in the sources consulted, and the record lists no fixed versions.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0113 affects Google Android and is described as an out-of-bounds write in ns_GetUserData of ns_SmscbUtilities.c. The weakness is classified as CWE-787 (Out-of-bounds Write). The root cause given in the record is an incorrect bounds check.

Impact

  • The record states that the flaw could lead to remote escalation of privilege.
  • The record states that no additional execution privileges are needed and that user interaction is not needed.
  • The CNA score is 9.8, and CISA ADP reports the same score. The SSVC data in the record shows exploitation as none, automatable as yes, and technical impact as total.

Affected products and versions

  • Product listed: Google Android.
  • The record lists the affected entries as versions not specified by the source and the Android kernel component.
  • No version numbers are given in the record, so no affected version range can be stated from it.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00318 with a percentile of 0.23484.

Remediation and mitigation

  • Review the Google Android security bulletin referenced in the record and apply the vendor updates that address this CVE.
  • The record contains no fixed versions, so confirm the patched build directly with the vendor bulletin and device update channels.
  • Prioritize devices and fleets where the vulnerable Android component is in use, given the critical score and the remote scope described.

Detection guidance

  • Track Android security patch status across managed devices and flag devices that have not received the referenced bulletin updates.
  • Monitor for abnormal crashes, memory faults or unexpected process behavior in telephony or messaging related components, as a defensive signal only.
  • No specific detection signatures are provided in the sources consulted.

Limitations of the available information

The record does not provide affected version numbers, fixed versions, exploit status beyond the absence of KEV listing, or detailed technical analysis. The exact product scope within Android is not clarified. The EPSS date in the record is later than the publication date and should be verified against the source before reliance.

Frequently asked questions

What is CVE-2026-0113?

It is an out-of-bounds write in ns_GetUserData of ns_SmscbUtilities.c in Google Android, caused by an incorrect bounds check, according to the record.

Is this vulnerability being exploited in the wild?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record does not specify affected version numbers, so the exact affected versions cannot be determined from it. Check the vendor bulletin.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.