CVE-2026-0117: Google Android Privilege Escalation Flaw

CVE-2026-0117 Overview

CVE-2026-0117 is an out-of-bounds write vulnerability in the mfc_dec_dqbuf function of mfc_dec_v4l2.c, a Multi-Format Codec (MFC) decoder component in the Android kernel. The flaw stems from an incorrect bounds check during video buffer dequeue operations. A local attacker can trigger the write to corrupt kernel memory and escalate privileges. Exploitation requires no user interaction and no additional execution privileges. Google addressed the issue in the Android Security Bulletin published on March 1, 2026.

Critical Impact

Local privilege escalation to kernel context on affected Android devices through memory corruption in the V4L2 MFC decoder, with no user interaction required.

Affected Products

• Google Android (MFC decoder kernel component mfc_dec_v4l2.c)
• Pixel devices covered by the March 2026 Pixel Security Bulletin
• Android OEM devices using the affected MFC V4L2 driver

Discovery Timeline

• 2026-03-01 - Google publishes the Android Security Bulletin addressing the issue
• 2026-03-10 - CVE-2026-0117 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-0117

Vulnerability Analysis

The vulnerability resides in mfc_dec_dqbuf, the function responsible for handling the Video for Linux 2 (V4L2) VIDIOC_DQBUF ioctl in the Multi-Format Codec decoder driver. The function performs a bounds check on a buffer index or size, but the check is incorrect. As a result, the driver writes past the end of a kernel buffer when processing a dequeue request. The flaw is classified as an out-of-bounds write [CWE-787]. Because the corruption occurs inside kernel memory, an attacker holding only the ability to open the MFC video device node can manipulate adjacent kernel structures. Successful exploitation yields kernel-level code execution and full local privilege escalation.

Root Cause

The root cause is an incorrect bounds check in mfc_dec_dqbuf within mfc_dec_v4l2.c. The validation logic fails to constrain a buffer-related index or length before the driver writes data on behalf of the caller. The driver therefore trusts attacker-influenced state during buffer dequeue and writes outside the intended allocation.

Attack Vector

Exploitation is local. An attacker with code execution on the device — for example, through a malicious application installed on the handset — opens the MFC V4L2 device node and issues a crafted sequence of V4L2 ioctls that trigger mfc_dec_dqbuf. The out-of-bounds write is then used to overwrite kernel data structures and gain elevated privileges. No user interaction is required after the malicious code begins executing. The vulnerability affects confidentiality, integrity, and availability at the kernel level.

No public proof-of-concept code is currently available. Refer to the Android Security Bulletin March 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-0117

Indicators of Compromise

• Unexpected kernel oops, panic, or KASAN reports referencing mfc_dec_dqbuf or mfc_dec_v4l2
• Untrusted applications accessing /dev/video* nodes associated with the MFC decoder
• Anomalous use of VIDIOC_DQBUF ioctl sequences from non-media processes

Detection Strategies

• Monitor mobile device management (MDM) telemetry for devices running Android security patch levels prior to 2026-03-01
• Inspect kernel logs (dmesg, logcat -b kernel) for out-of-bounds write warnings within media drivers
• Hunt for installed applications that request access to low-level video device nodes without a legitimate media use case

Monitoring Recommendations

• Track Android security patch level (ro.build.version.security_patch) across the device fleet to confirm March 2026 or later patches are applied
• Alert on applications loaded from sideloaded sources that interact with V4L2 ioctls
• Forward device security posture events to a centralized data lake to correlate patch state with post-exploitation behavior

How to Mitigate CVE-2026-0117

Immediate Actions Required

• Apply the March 2026 Android security patch (security patch level 2026-03-01 or later) to all managed Android devices
• For Pixel devices, install the March 2026 Pixel update covered by the Pixel Security Bulletin
• Enforce minimum patch level policies through MDM and block enrollment of devices below the required baseline

Patch Information

Google released fixes in the Android Security Bulletin March 2026. OEMs ship the corresponding kernel changes through their device-specific updates. Pixel-specific fixes are documented in the Pixel Security Bulletin March 2026. The patch corrects the bounds check in mfc_dec_dqbuf so that buffer indices and sizes are validated before any write occurs.

Workarounds

• Restrict installation of untrusted applications and disable sideloading on managed devices until patches are applied
• Use Android work profile or enterprise policies to limit application access to media device nodes
• Retire or quarantine end-of-life devices that will not receive the March 2026 patch

# Verify the Android security patch level on a device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-03-01 or later