CVE-2026-0177: Crypto-AES Information Disclosure Vulnerability

CVE-2026-0177 Overview

CVE-2026-0177 is an out-of-bounds read vulnerability in the do_sss_aes_gcm_256_op function of crypto-aes.c. The flaw stems from a missing bounds check during AES-GCM 256 cryptographic operations. Successful exploitation results in local information disclosure from memory adjacent to the operation buffer. Exploitation requires System-level execution privileges and does not require user interaction. The issue is documented in the Android Security Bulletin for September 2026 affecting Pixel devices. This vulnerability falls under [CWE-120] Buffer Copy without Checking Size of Input.

Critical Impact
Local information disclosure of sensitive memory contents through the Secure Sub-System (SSS) AES-GCM cryptographic routine, potentially exposing cryptographic material or adjacent buffer data.

Affected Products

Google Pixel devices as listed in the Android Security Bulletin (Pixel) September 2026
Android components implementing the crypto-aes.c Secure Sub-System driver
Devices using the affected AES-GCM 256 cryptographic operation path

Discovery Timeline

2026-09-15 - CVE-2026-0177 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-0177

Vulnerability Analysis

The defect resides in the do_sss_aes_gcm_256_op routine within crypto-aes.c, which handles AES-GCM 256 cryptographic operations through the Secure Sub-System. The function processes input data without validating the size of a buffer boundary before performing a read. An attacker with System privileges can invoke the affected code path with parameters that cause the routine to read past the intended buffer. The read data is returned to the caller, disclosing information from adjacent memory regions. Because the affected function operates within a cryptographic context, leaked memory can include key material, initialization vectors, or plaintext fragments processed by prior operations.

Root Cause

The root cause is a missing bounds check before a memory read operation inside do_sss_aes_gcm_256_op. The code assumes the caller provides a length parameter consistent with the underlying buffer allocation. When the supplied length exceeds the actual buffer size, the function reads beyond the allocated region. This maps to [CWE-120], reflecting insufficient validation of input sizes in a copy operation.

Attack Vector

Exploitation is local and requires the attacker to already hold System execution privileges on the device. No user interaction is required. An attacker running code within a System context invokes the vulnerable cryptographic API with crafted parameters. The returned output includes data read from memory outside the intended buffer. This vulnerability is used as a post-compromise primitive, typically chained after an initial code execution or privilege escalation flaw to extract secrets from process memory.

No public proof-of-concept is available. Technical details are referenced in the Android Security Bulletin September 2026.

Detection Methods for CVE-2026-0177

Indicators of Compromise

Unexpected invocations of Secure Sub-System AES-GCM APIs from processes that do not normally perform cryptographic operations
System-privileged processes issuing cryptographic requests with anomalous length parameters
Crashes or kernel log entries referencing do_sss_aes_gcm_256_op or crypto-aes.c

Detection Strategies

Monitor for privilege escalation chains that culminate in access to System-level cryptographic interfaces
Baseline normal callers of the SSS crypto driver and alert on deviations
Correlate abnormal cryptographic API usage with prior local exploitation attempts on the same device

Monitoring Recommendations

Ingest Android device logs and kernel telemetry into a centralized analytics platform for review
Track patch level compliance across the mobile fleet against the September 2026 Android Security Bulletin
Flag devices that remain on pre-patch Android security patch levels for expedited remediation

How to Mitigate CVE-2026-0177

Immediate Actions Required

Apply the September 2026 Android Security Bulletin patch for Pixel devices as soon as it is available from the device vendor
Verify the Android security patch level on managed devices matches or exceeds the 2026-09-01 patch level
Restrict installation of unverified applications that could be leveraged to escalate to System privileges

Patch Information

The fix is delivered through the Android Security Bulletin (Pixel) for September 2026. Refer to the Android Security Bulletin September 2026 for the corresponding source patch and affected component details. Device vendors distribute the fix through over-the-air updates aligned to the 2026-09-01 security patch level.

Workarounds

No vendor-supplied workaround is documented; apply the security patch as the primary remediation
Enforce mobile device management policies that require the latest Android security patch level for enterprise access
Reduce attack surface by limiting sideloaded applications and enforcing verified boot on managed devices

bash

# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch

# Expected output should be 2026-09-01 or later