What is the CVSS score of CVE-2026-0121?

CVE-2026-0121 has a CVSS 3.1 base score of 2.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-0121?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

CVE-2026-0121

LOW

Race Condition (CWE-362)

2026-03-10 dsap-vuln-management@google.com

Information Disclosure Race Condition

2.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 21:16 nvd

LOW 2.9

DescriptionCVE.org

In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. [CVSS 2.9 LOW]

Technical ContextAI

Classified as CWE-362 (Race Condition). Affects Android. In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.