CVE-2026-0147: In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q

Synopsis

Out-of-bounds write in the Android kernel's MFC core NAL queue handler allows a network-reachable, low-privileged attacker to execute arbitrary code. The flaw exists in __mfc_core_nal_q_get_dec_metadata_sei_nal in mfc_core_nal_q.c, where a missing bounds check on a write operation can be triggered without any victim interaction. Successful exploitation gives the attacker full code execution in the kernel context, enabling complete device compromise. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The CVSS vector specifies AV:N, meaning an attacker must be able to reach the vulnerable service over the network to trigger the out-of-bounds write.

• AuthenticationRequired

  The CVSS vector specifies PR:L, meaning any low-privilege account or credential is sufficient; no administrative access is needed.

• Victim interactionNot required

  The CVSS vector specifies UI:N, meaning the attacker can complete exploitation without any action from a user on the affected device.

• Attack complexityDetail

  The CVSS vector specifies AC:L, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific preconditions.

Blast Radius

• Attacker achieves arbitrary code execution in the Android kernel context, gaining full control over the affected device.
• Attacker reads any data accessible to the kernel, including credentials, session tokens, and application memory.
• Attacker modifies kernel memory and persisted storage, enabling installation of persistent backdoors or malware.
• Attacker can crash or destabilize the kernel, causing a denial of service to all processes on the device.