EUVD-2026-37176
GHSA-qp8c-664j-7vcm
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Local reachability of the AVB key parser (AV:L), no privileges or interaction needed (PR:N/UI:N), and an OOB read leaking limited memory yields C:L with no I/A impact.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local information disclosure in Android Verified Boot (AVB) allows an attacker with local access to read a small amount of out-of-bounds memory by supplying malformed RSA key data to the iavb_parse_key_data function in avb_rsa.c. The vulnerability affects Google Android devices (CPE: cpe:2.3:a:google:android) and requires local access, no additional execution privileges (PR:N), and no user interaction (UI:N) per the CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.09%, 1st percentile; CISA SSVC exploitation: none), and the impact is limited to confidentiality (C:L) with no integrity or availability effect.
Technical ContextAI
The vulnerability resides in Android Verified Boot (AVB), a chain-of-trust mechanism that validates the integrity of boot images using RSA keys. The flawed function iavb_parse_key_data in avb_rsa.c performs improper input validation (CWE-20) on RSA key data, leading to an out-of-bounds read. An attacker with local access must be able to supply malformed or untrusted RSA key data to this parser, for example by loading a crafted boot image or key blob. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the attack is local, requires no privileges or user interaction, and results in only a low-confidentiality impact (memory disclosure). The affected CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, and EUVD identifies the affected component as the Android kernel. Remote exploitation is not possible per the assessed vector. SSVC decision points indicate exploitation: none, automatable: no, and partial technical impact, aligning with the low severity (CVSS 4.0).
RemediationAI
Apply the Android Security Bulletin patch for June 2026 (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01); patch availability is indicated by the vendor advisory, though the exact patched version is not specified in the provided data. As an immediate compensating control, keep the device bootloader locked and OEM unlocking disabled to prevent a local attacker from loading a crafted boot image or key data that reaches the iavb_parse_key_data parser; this trade-off blocks installation of custom ROMs and may hinder legitimate development. Additionally, restrict physical access to devices and enforce a strong screen lock to limit opportunities for local exploitation. Since the attack vector is local (AV:L), network-based mitigations are not applicable.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-20 – Improper Input Validation
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today