CVE-2026-0126: WC-Radio out-of-bounds write with possible remote code execution
CVE-2026-0126 is a critical out-of-bounds write caused by a missing bounds check, according to its description. The record states it could allow remote code execution without additional privileges and without user interaction. The only vendor reference provided is an Android Pixel security bulletin, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-0126 describes a possible out-of-bounds write caused by a missing bounds check, mapped to CWE-787 (Out-of-bounds Write). The record states that exploitation could lead to remote code execution with no additional execution privileges and without user interaction.
Impact
- The description points to remote code execution as the possible outcome of the flaw.
- NVD's CVSS base score is 9.8 (critical). The reported metrics describe network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- Another provider in the record lists a score of 8.8, and CISA-ADP also lists 8.8.
Affected products and versions
- The record lists Google Android as the affected product, with the affected versions not specified by the source.
- The description names WC-Radio, which the record does not reconcile with the Android listing.
- No affected version ranges or fixed versions are provided in the record.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record.
- The SSVC data in the record gives exploitation as none and automatable as no.
- The EPSS probability is about 0.28% with a percentile of about 19.1%.
- No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Review the Android Pixel security bulletin cited in the record and check whether affected devices or components are listed.
- Apply vendor updates for affected Android devices as soon as they are available, since the record does not include fixed versions.
- Confirm with the vendor whether WC-Radio is a separate product, component or third-party software, and whether it is covered by the Android bulletin.
- Limit network exposure of affected services and devices while patches are pending, as general hardening.
Detection guidance
- Inventory devices and software that may include the affected Android components or the WC-Radio functionality.
- Monitor for unexpected crashes, memory faults or abnormal behavior in radio-related services and review vendor telemetry where available.
- Keep logs of network-facing services to support investigation if vulnerable behavior is observed.
Limitations of the available information
- The record has no title, so titles in this analysis are derived from the description and affected product fields.
- The product named in the description (WC-Radio) and the listed affected product (Google Android) are not reconciled in the record.
- No affected version ranges, fixed versions or patch details are provided by the record.
- The EPSS date in the record is later than the publication date and should be treated with caution.
- The CVSS scores differ between providers, and the record does not explain the difference.
Frequently asked questions
Is CVE-2026-0126 being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC data also gives exploitation as none.
Which versions are affected?
The record does not specify affected versions or fixed versions. It lists Google Android as the affected product, but the source does not specify the versions, so administrators should check the vendor bulletin.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.