A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Six years. Gartner® Magic Quadrant™ Leader.Find Out Why
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2026-0117

CVE-2026-0117: Google Android Privilege Escalation Flaw

CVE-2026-0117 is a privilege escalation vulnerability in Google Android caused by an out of bounds write in mfc_dec_v4l2.c. This flaw enables local attackers to gain elevated privileges. This article covers technical details, affected versions, impact, and mitigation strategies.

Updated: May 14, 2026

CVE-2026-0117 Overview

CVE-2026-0117 is an out-of-bounds write vulnerability in the mfc_dec_dqbuf function of mfc_dec_v4l2.c, a Multi-Format Codec (MFC) decoder component in the Android kernel. The flaw stems from an incorrect bounds check during video buffer dequeue operations. A local attacker can trigger the write to corrupt kernel memory and escalate privileges. Exploitation requires no user interaction and no additional execution privileges. Google addressed the issue in the Android Security Bulletin published on March 1, 2026.

Critical Impact

Local privilege escalation to kernel context on affected Android devices through memory corruption in the V4L2 MFC decoder, with no user interaction required.

Affected Products

  • Google Android (MFC decoder kernel component mfc_dec_v4l2.c)
  • Pixel devices covered by the March 2026 Pixel Security Bulletin
  • Android OEM devices using the affected MFC V4L2 driver

Discovery Timeline

  • 2026-03-01 - Google publishes the Android Security Bulletin addressing the issue
  • 2026-03-10 - CVE-2026-0117 published to NVD
  • 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-0117

Vulnerability Analysis

The vulnerability resides in mfc_dec_dqbuf, the function responsible for handling the Video for Linux 2 (V4L2) VIDIOC_DQBUF ioctl in the Multi-Format Codec decoder driver. The function performs a bounds check on a buffer index or size, but the check is incorrect. As a result, the driver writes past the end of a kernel buffer when processing a dequeue request. The flaw is classified as an out-of-bounds write [CWE-787]. Because the corruption occurs inside kernel memory, an attacker holding only the ability to open the MFC video device node can manipulate adjacent kernel structures. Successful exploitation yields kernel-level code execution and full local privilege escalation.

Root Cause

The root cause is an incorrect bounds check in mfc_dec_dqbuf within mfc_dec_v4l2.c. The validation logic fails to constrain a buffer-related index or length before the driver writes data on behalf of the caller. The driver therefore trusts attacker-influenced state during buffer dequeue and writes outside the intended allocation.

Attack Vector

Exploitation is local. An attacker with code execution on the device — for example, through a malicious application installed on the handset — opens the MFC V4L2 device node and issues a crafted sequence of V4L2 ioctls that trigger mfc_dec_dqbuf. The out-of-bounds write is then used to overwrite kernel data structures and gain elevated privileges. No user interaction is required after the malicious code begins executing. The vulnerability affects confidentiality, integrity, and availability at the kernel level.

No public proof-of-concept code is currently available. Refer to the Android Security Bulletin March 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-0117

Indicators of Compromise

  • Unexpected kernel oops, panic, or KASAN reports referencing mfc_dec_dqbuf or mfc_dec_v4l2
  • Untrusted applications accessing /dev/video* nodes associated with the MFC decoder
  • Anomalous use of VIDIOC_DQBUF ioctl sequences from non-media processes

Detection Strategies

  • Monitor mobile device management (MDM) telemetry for devices running Android security patch levels prior to 2026-03-01
  • Inspect kernel logs (dmesg, logcat -b kernel) for out-of-bounds write warnings within media drivers
  • Hunt for installed applications that request access to low-level video device nodes without a legitimate media use case

Monitoring Recommendations

  • Track Android security patch level (ro.build.version.security_patch) across the device fleet to confirm March 2026 or later patches are applied
  • Alert on applications loaded from sideloaded sources that interact with V4L2 ioctls
  • Forward device security posture events to a centralized data lake to correlate patch state with post-exploitation behavior

How to Mitigate CVE-2026-0117

Immediate Actions Required

  • Apply the March 2026 Android security patch (security patch level 2026-03-01 or later) to all managed Android devices
  • For Pixel devices, install the March 2026 Pixel update covered by the Pixel Security Bulletin
  • Enforce minimum patch level policies through MDM and block enrollment of devices below the required baseline

Patch Information

Google released fixes in the Android Security Bulletin March 2026. OEMs ship the corresponding kernel changes through their device-specific updates. Pixel-specific fixes are documented in the Pixel Security Bulletin March 2026. The patch corrects the bounds check in mfc_dec_dqbuf so that buffer indices and sizes are validated before any write occurs.

Workarounds

  • Restrict installation of untrusted applications and disable sideloading on managed devices until patches are applied
  • Use Android work profile or enterprise policies to limit application access to media device nodes
  • Retire or quarantine end-of-life devices that will not receive the March 2026 patch
bash
# Verify the Android security patch level on a device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-03-01 or later

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypePrivilege Escalation

  • Vendor/TechGoogle Android

  • SeverityHIGH

  • CVSS Score8.4

  • EPSS Probability0.01%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityHigh
  • CWE References
  • CWE-787
  • Vendor Resources
  • Android Security Bulletin March 2026

  • Pixel Security Bulletin March 2026
  • Related CVEs
  • CVE-2025-22424: Google Android Privilege Escalation Flaw

  • CVE-2026-0095: Google Android Privilege Escalation Flaw

  • CVE-2026-0094: Google Android Privilege Escalation Flaw

  • CVE-2026-0093: Google Android Privilege Escalation Flaw
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English