AI description
Automated description summarized from trusted sources.
CVE-2026-0153 is an out-of-bounds write vulnerability found in the `msg_to_host_buffer.cc` component of the Android kernel, specifically impacting Google's EdgeTPU. This flaw stems from an incorrect bounds check, which could allow for local escalation of privilege. Exploitation of this vulnerability does not require additional execution privileges or user interaction. Discovered by researchers at CertiK, CVE-2026-0153 was addressed by Google and included in its June 2026 Security Bulletin.
- Description
- In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Source
- dsap-vuln-management@google.com
- NVD status
- Undergoing Analysis
- Products
- android
CVSS 3.1
- Type
- Secondary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-787
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]