Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-0171: Software can let attackers run code remotely
CVE-2026-0171 · published 2 months ago
Summary
A coding mistake in several parts of the software could let a remote attacker place data where it shouldn't be, giving them the ability to run their own commands on the system. This can happen without any user clicking anything or having special access. Update the software to the latest version or apply the vendor’s fix as soon as possible, and limit network access to the affected system until it is patched.
What to do
- Update google :unknown: to version Pixel-family specific:2026-09-05.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | android | Android kernel | |
| Android | :unknown: |
>= Pixel-family specific:0, < Pixel-family specific:2026-09-05 Fix: upgrade to Pixel-family specific:2026-09-05
|
Original advisory text
In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User intera...
In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
References
- https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01 Vendor Advisory
- https://source.android.com/security/bulletin/2026-09-01 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-787Out-of-bounds Write
Timeline
Published1 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Track software like this
Free during beta