Use After Free Vulnerability in Android's vpu_ioctl.c Affected by Race Condition
CVE-2026-0112

7.4HIGH

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
10 March 2026

What is CVE-2026-0112?

A vulnerability exists in the vpu_ioctl.c component of Android, stemming from a potential use-after-free condition caused by a race condition. This flaw may enable local users to escalate their privileges without requiring any additional execution permissions or user interaction, effectively increasing the risk of unauthorized actions on the device.

Affected Version(s)

Android Android kernel

References

https://source.android.com/docs/security/bulletin/2026/20...
vendor-advisory

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.