CVE-2026-0122: Android Pixel-family Out of Bounds Write Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-0122: In multiple places, there is a possible out of bounds write due to memory corruption. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2026-03-05. Fixed in Pixel-family specific:2026-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android operating system is a widely used open-source platform for mobile devices, known for its flexibility and extensive app ecosystem. The Pixel-family devices, developed by Google, leverage Android's capabilities to provide a seamless user experience. However, like any software, Android is susceptible to vulnerabilities that can compromise device security. This particular vulnerability affects specific versions of the Pixel-family devices, allowing for potential exploitation.
Vulnerability Detail
In multiple locations within the Android Pixel-family ecosystem, there exists a possible out of bounds write due to memory corruption. This flaw can lead to remote code execution (RCE) without requiring additional execution privileges. The vulnerability does not necessitate user interaction for exploitation, making it particularly critical and dangerous.
How To Fix
Minimum fixed version
Pixel-family specific:2026-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch as soon as it is released.
Conclusion
The CVE-2026-0122 vulnerability presents a significant risk to users of Android Pixel-family devices, allowing for remote code execution without user interaction. It is imperative for users to update their devices to the patched version released on March 5, 2026, to protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2026-0122 is a critical vulnerability in the Android Pixel-family devices that allows for remote code execution due to an out of bounds write caused by memory corruption.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
While there are no specific workarounds, it is crucial to prioritize updating your device to mitigate the risk associated with this vulnerability.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
The vulnerability could lead to remote code execution, allowing attackers to execute arbitrary code on the affected devices, potentially compromising user data and device integrity.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
