CVE-2026-0194

HighCVSS 8.4/10Last modified Sep 21, 2026

Description

In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
Google	Android	Android kernel

References

https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01Vendor Advisory

Timeline

Published: Sep 15, 2026
Last modified: Sep 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-01954.0In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due to a logic error. Th CVE-2026-01974.4In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local information disclosure with S CVE-2026-01984.4In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information CVE-2026-01997.8In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local CVE-2026-02008.8In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege CVE-2026-02036.5An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS allows an unauthenticated, ne CVE-2026-02048.0A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific CVE-2026-02056.8A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services.CVE-2026-02064.9A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall.CVE-2026-02078.5A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions.CVE-2026-02096.9Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.CVE-2026-02277.5A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall