CVE-2026-0117: Google Android Privilege Escalation Flaw

CVE-2026-0117 Overview

CVE-2026-0117 is an out-of-bounds write vulnerability in the mfc_dec_dqbuf function within mfc_dec_v4l2.c on Google Android devices. The flaw stems from an incorrect bounds check in the Multi-Format Codec (MFC) decoder component, which handles video decoding operations. This vulnerability enables local privilege escalation without requiring any user interaction or additional execution privileges.

Critical Impact

Successful exploitation allows attackers to achieve local privilege escalation on affected Android devices, potentially gaining elevated system access through the vulnerable MFC decoder component.

Affected Products

• Google Android (all versions prior to the March 2026 security patch)
• Google Pixel devices (prior to March 2026 security update)

Discovery Timeline

• 2026-03-10 - CVE-2026-0117 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-0117

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-Bounds Write), a memory corruption flaw that occurs when the MFC decoder writes data outside the intended buffer boundaries. The mfc_dec_dqbuf function in the V4L2 (Video4Linux2) driver interface fails to properly validate buffer indices or sizes before performing write operations.

The MFC decoder is a critical hardware-accelerated video decoding component used on many Android devices, particularly Samsung Exynos-based platforms and Google Pixel devices. When processing video frames during the dequeue buffer operation, improper bounds validation allows an attacker to corrupt adjacent memory regions.

The local attack vector means exploitation requires code execution on the device, but notably does not require elevated privileges or user interaction. This makes the vulnerability particularly dangerous in scenarios where an attacker has already achieved limited code execution through another vector, as it provides a reliable path to privilege escalation.

Root Cause

The root cause lies in incorrect bounds checking within the mfc_dec_dqbuf function. When the V4L2 subsystem dequeues decoded video buffers from the MFC hardware decoder, the function fails to properly validate buffer parameters against allocated memory boundaries. This allows write operations to extend beyond the intended buffer, corrupting kernel memory structures that can be leveraged for privilege escalation.

Attack Vector

The vulnerability is exploited locally on the device. An attacker with the ability to execute code (such as through a malicious application) can interact with the MFC decoder through the V4L2 interface. By crafting specific video decoding requests with malformed buffer parameters, the attacker can trigger the out-of-bounds write condition.

The exploitation path involves:

1. Opening the MFC decoder device through the V4L2 interface
2. Setting up video decoding parameters to manipulate buffer allocation
3. Triggering the vulnerable dequeue operation with crafted parameters
4. Overwriting kernel memory structures to achieve privilege escalation

Since no user interaction is required, the attack can proceed silently once malicious code is executing on the device. The vulnerability affects the kernel driver layer, meaning successful exploitation grants kernel-level privileges.

Detection Methods for CVE-2026-0117

Indicators of Compromise

• Unexpected crashes or kernel panics related to the MFC decoder or V4L2 subsystem
• Anomalous access patterns to /dev/video* device nodes associated with MFC
• Applications with no legitimate video decoding needs accessing MFC decoder interfaces
• Suspicious privilege escalation events following video decoding activity

Detection Strategies

• Monitor for unusual ioctl calls to MFC decoder device nodes, particularly VIDIOC_DQBUF operations with abnormal parameters
• Implement kernel auditing for V4L2 device access by unprivileged applications
• Deploy endpoint detection solutions capable of monitoring kernel driver interactions
• SentinelOne Singularity platform provides behavioral detection for privilege escalation attempts stemming from driver exploitation

Monitoring Recommendations

• Enable enhanced logging for V4L2 subsystem operations where possible
• Monitor application behavior for unexpected video device access patterns
• Implement application whitelisting for access to hardware decoder interfaces
• Deploy SentinelOne agents to detect and prevent exploitation attempts through behavioral analysis

How to Mitigate CVE-2026-0117

Immediate Actions Required

• Apply the March 2026 Android Security Bulletin updates immediately
• Prioritize patching for Pixel devices and other affected Android platforms
• Restrict untrusted application installation until patches are applied
• Review installed applications for suspicious video codec access patterns

Patch Information

Google has addressed this vulnerability in the Android Security Bulletin March 2026 and the Pixel Security Bulletin March 2026. Device manufacturers should integrate the relevant patches from the Android Open Source Project (AOSP) and release updates to affected devices.

For Pixel devices, ensure the device is updated to the March 2026 security patch level or later. Enterprise administrators should enforce security update policies to ensure devices receive critical patches in a timely manner.

Workarounds

• Limit application installation to trusted sources (Google Play Store with Play Protect enabled)
• Implement Mobile Device Management (MDM) policies to restrict access to camera and video functionality for untrusted applications
• Consider disabling video playback in high-risk applications until patching is complete
• Deploy SentinelOne Mobile Threat Defense for real-time protection against exploitation attempts on Android devices