What is the CVSS score of CVE-2026-0010?

CVE-2026-0010 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by CVE-2026-0010?

A high-severity vulnerability in Android's DRM service allows local attackers to escalate privileges without additional permissions, potentially compromising device security and sensitive data.

How to fix or mitigate CVE-2026-0010?

Within 24 hours: Inventory all affected Android devices in your environment and assess exposure by user role and data sensitivity. Within 7 days: Implement network segmentation to restrict DRM service access where feasible, disable unnecessary DRM features if not critical to operations, and enforce application whitelisting on high-risk devices. Within 30 days: Monitor vendor security advisories for patch availability and establish an expedited deployment plan; conduct security awareness training on the risks of sideloading applications.

Google CVE-2026-0010

HIGH

Out-of-bounds Write (CWE-787)

2026-03-02 security@android.com

Privilege Escalation Buffer Overflow Google Memory Corruption

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 19:16 nvd

HIGH 8.4

DescriptionNVD

In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Android's DRM manager service allows unprivileged processes to achieve system-level access through an out-of-bounds memory write in the IDrmManagerService transaction handler. The vulnerability requires no user interaction and can be exploited immediately upon execution, making it a direct path to elevated privileges on affected Android devices. No patch is currently available.

Technical ContextAI

Classified as CWE-787 (Out-of-bounds Write). Affects Android. In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.