EUVD-2026-78971

| CVE-2026-56950 MEDIUM

Improper Input Validation (CWE-20)

2026-09-15 Google_Devices

GHSA-m4hf-fq7w-g9rv

Information Disclosure

4.4

CVSS 3.1 · Vendor: Google_Devices

Severity by source

Vendor (Google_Devices) PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Google_Devices) · only source for this CVE.

CVSS VectorVendor: Google_Devices

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 22:04 vuln.today

CVE Published

Sep 15, 2026 - 18:34 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In validate_ns_buf of mbu_class.rs, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Improper input validation in the MBU class handler (validate_ns_buf in mbu_class.rs) of the Android kernel allows a component already running with System execution privileges to supply a malformed namespace buffer and read kernel memory beyond the intended bounds, disclosing sensitive data. Affected are Android devices built on the impacted kernel (CPE cpe:2.3:a:google:android) as addressed by the September 2026 Android/Pixel security bulletin. …