CVE Intelligence
Analysis AI-assisted

CVE-2026-0120: Google Android Modem Out-of-Bounds Write Vulnerability

CVE-2026-0120 is a critical out-of-bounds write in the modem component of Google Android, caused by an incorrect bounds check. According to the record, it could allow remote code execution without additional execution privileges and without user interaction. The sources consulted do not show confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0120 affects the modem component of Google Android. The record describes an out-of-bounds write caused by an incorrect bounds check (CWE-787). The Google Devices CNA published the entry on 2026-03-10 and the vendor bulletins linked in the record are the main primary references.

Impact

  • The record states that the flaw could lead to remote code execution.
  • It states that no additional execution privileges are needed and that user interaction is not needed.
  • The CVSS base score is 9.8 (critical) and the SSVC data in the record marks technical impact as total and automatable as yes.
  • Confidentiality, integrity and availability impacts are rated high in the CVSS vector, as shown in the record.

Affected products and versions

  • The record lists Google Android as the affected product, with the entries 'versions not specified by the source' and 'version Android kernel'.
  • No specific affected version ranges are provided in the record, so this analysis does not state any.

Exploitation status

  • The CISA KEV catalog entry in the record is not listed.
  • The SSVC exploitation field is marked as none.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The record contains no fixed versions. This does not mean no fix exists; it means the record does not provide one.
  • Administrators and device owners should consult the Android Security Bulletin for March 2026 and the Pixel Security Bulletin for March 2026 and apply the updates listed for their devices.
  • Keep devices on supported security patch levels and follow vendor or carrier update schedules.

Detection guidance

  • Monitor device fleets for unexpected modem-related crashes, resets or connectivity anomalies, which may warrant review at a high level.
  • Track update compliance across managed Android devices against the vendor bulletins.

Limitations of the available information

  • The record does not specify affected Android versions or patch levels.
  • No fixed version or patch identifier is listed in the record.
  • No public exploit details or proof-of-concept information are included in the record, and none are provided here.
  • The EPSS values are included for context only and do not confirm exploitation.

Frequently asked questions

What is CVE-2026-0120?

It is a critical out-of-bounds write in the modem component of Google Android, caused by an incorrect bounds check, as described in the record.

Does the record say the flaw can be exploited remotely?

The record states that it could lead to remote code execution without additional execution privileges and without user interaction.

Is this CVE known to be actively exploited?

The CISA KEV entry is not listed in the record and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record does not specify affected version ranges. Check the Android and Pixel security bulletins for device-specific details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.