What is the CVSS score of CVE-2026-0039?

CVE-2026-0039 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Google Android CVE-2026-0039

EUVD-2026-33770 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-06-01 google_android

GHSA-2p3w-56f5-gwxv

Denial Of Service Integer Overflow

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 00:24 vuln.today

CVSS changed

Jun 02, 2026 - 00:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 01, 2026 - 21:14 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 01, 2026 - 21:14 nvd

MEDIUM 6.5

DescriptionCVE.org

In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Persistent denial of service in Google Android's UBSAN throwing runtime allows a remote low-privileged attacker to crash affected devices via an integer overflow in multiple functions of ubsan_throwing_runtime.cpp. Affected versions span Android 14, 15, 16-qpr2, and 16, indicating broad exposure across the current supported Android ecosystem. No public exploit code or active exploitation has been identified at time of analysis; patches are available via the June 2026 Android Security Bulletin.

Technical ContextAI

The vulnerability resides in ubsan_throwing_runtime.cpp, part of Android's UBSAN (UndefinedBehaviorSanitizer) runtime - a compiler instrumentation layer that detects undefined behavior such as integer overflows, out-of-bounds accesses, and misaligned pointers at runtime. CWE-190 (Integer Overflow or Wraparound) describes the root cause: arithmetic operations in multiple functions within this runtime component fail to bounds-check computed values, allowing an integer to wrap around and produce an unexpected result. In a throwing runtime context, this overflow likely corrupts internal state in a way that triggers an unrecoverable condition, resulting in a persistent system-level denial of service. The CPE string cpe:2.3:a:google:android:*:*:*:*:*:*:*:* with EUVD-confirmed affected versions (Android 14, 15, 16-qpr2, 16) confirms this is a broad platform-level issue, not isolated to a single OEM or build.

RemediationAI

Apply the patches released in the June 2026 Android Security Bulletin (https://source.android.com/docs/security/bulletin/2026/2026-06-01), which addresses CVE-2026-0039 across Android 14, 15, 16-qpr2, and 16. Exact patched build numbers should be confirmed from the bulletin itself, as the input data does not specify a precise fix version string. OEM and carrier-customized Android builds may have delayed rollout timelines; device administrators should monitor OEM-specific security bulletins (Samsung, Pixel, etc.) for downstream patch availability. As a compensating control prior to patching, restrict network-accessible low-privilege services on Android devices where feasible - particularly in managed enterprise environments - to reduce the pool of potential attackers who meet the PR:L prerequisite. Note that this mitigation does not eliminate the vulnerability and may impact legitimate service functionality.