CVE-2026-0150

HighCVSS 7.8/10Last modified Oct 25, 2026

Description

In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with root privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190CWE-787

Affected software

VendorProductVersions
GoogleAndroidAndroid kernel

References

Timeline

Published
Jun 16, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-01518.8In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code executCVE-2026-01527.8In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of boundCVE-2026-01537.8In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalaCVE-2026-01548.8In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote coCVE-2026-01555.3In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information discCVE-2026-01567.5In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remoteCVE-2026-01574.3In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosurCVE-2026-01584.0In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disCVE-2026-01598.8In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no aCVE-2026-01608.8In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds cCVE-2026-01618.8In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escCVE-2026-01628.8In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code executio
CVE-2026-0150: High severity, CVSS 7.8 | Vulnix