CVE-2026-0142: Android AVB RSA Key Parsing Out-of-Bounds Read Information Disclosure

Technical summary

The vulnerability resides in the iavb_parse_key_data function within avb_rsa.c, where insufficient input validation on cryptographic key data structures allows an attacker to read memory beyond allocated buffer boundaries. The flaw is classified as an out-of-bounds read (CWE-125) compounded by inadequate input validation (CWE-20). An unprivileged local process can invoke the vulnerable code path without requiring elevated privileges, user consent, or any interactive prompt. The attack surface is limited to the local system, but the confidentiality impact—though rated as 'low'—means that information in adjacent memory regions may be disclosed.

Business impact

This vulnerability poses a moderate operational concern for organizations deploying Android devices in security-sensitive environments. While the CVSS 3.1 score of 3.3 reflects a low overall severity, the absence of integrity or availability impact does not eliminate risk: leaked data from memory could include cryptographic material, authentication tokens, or other sensitive temporary state. For enterprises managing large Android fleets, even low-severity local disclosure vulnerabilities can accumulate into meaningful exposure when multiplied across devices. The fact that no user interaction is required simplifies the attack chain for malicious local applications or users with physical device access.

Affected systems

This issue affects Google Android systems that include the vulnerable AVB RSA parsing function. The exact range of affected Android versions is not specified in the published advisory; organizations must consult Google's official security bulletin to determine which release versions and patch levels are impacted. Devices running outdated or unpatched Android releases are at risk.

Exploitability

Exploitability is straightforward from a local vantage point. An attacker with local user privileges can craft and pass malformed key data to the iavb_parse_key_data function, triggering the out-of-bounds read without requiring root access, special capabilities, or user interaction. The simplicity of the attack vector—combined with the lack of additional privilege requirements—makes this vulnerability moderately exploitable by local threat actors, though the impact is confined to information disclosure.

Remediation

Remediation requires installing a patched Android build that corrects the input validation logic in avb_rsa.c. Google will provide security patches through the Android Security & Privacy Month security bulletin. Organizations should enable automatic security updates on managed devices and verify patch deployment through mobile device management (MDM) solutions. Until patches are available, limit local user account provisioning on sensitive devices and review access controls for applications that may interact with the AVB subsystem.

Patch guidance

Check Google's official Android security bulletin (published shortly after 2026-06-16) for the specific affected versions and patch versions. Apply security updates to all Android devices in your environment as soon as they are released and tested. If you operate an MDM solution, configure it to enforce patch compliance across your fleet. Verify the patch by confirming the updated avb_rsa.c binary in the device's build fingerprint. For critical deployments, consider staging patches in a test environment first to ensure compatibility before rolling out to production.

Detection guidance

Detection at runtime is difficult because the vulnerability is triggered by internal key parsing during boot or system initialization, not through external network services. However, organizations can monitor for: (1) unexpected process crashes or kernel warnings related to AVB or RSA operations, (2) anomalous access patterns by local applications to cryptographic subsystems, and (3) privilege escalation attempts that might chain this information leak with other vulnerabilities. Enable SELinux audit logging to capture attempts by unprivileged processes to interact with AVB key structures. Endpoint detection and response (EDR) solutions can flag suspicious local code paths, though AVB is a low-level bootloader component that most EDR tools may not directly instrument.

Why prioritize this

Prioritize this patch for devices in high-security environments or those handling sensitive data, such as financial, healthcare, or government deployments. While the CVSS score is low and exploitation requires local access, the combination of no user interaction requirement and the potential for information disclosure (especially if adjacent memory contains cryptographic keys) justifies timely patching. Organizations with open local user account policies should treat this with higher urgency. Less critical devices (e.g., personal consumer devices with locked-down user provisioning) can follow standard patch cadences.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW severity) reflects the limited scope: local access only, low confidentiality impact, and no integrity or availability impact. The attack vector and privilege requirements are minimal (user-level, no privileges), and no user interaction is needed, which prevents the score from being even lower. However, the score does not account for context-specific factors such as whether the device stores cryptographic material in adjacent memory or the organization's tolerance for local information disclosure.

Frequently asked questions