A critical out of bounds write vulnerability in the Android kernel could allow a local attacker to escalate privileges to the highest level of system access.

The flaw exists in the mfc_dec_dqbuf function within the mfc_dec_v4l2.c component of the Android kernel. An incorrect bounds check permits an out of bounds write, which can be triggered by an unprivileged local attacker without any required user interaction.

Successful exploitation of this vulnerability enables a local attacker to achieve full system compromise by escalating their privileges. Given the CVSS score of 8.4, this represents a high severity risk that could lead to unauthorized data access, complete system takeover, and the potential for persistent malicious activity on affected mobile devices.

Immediate Action: Apply the official security updates provided by Google in the March 2026 Android Security Bulletin to ensure the kernel is patched against this vulnerability.

Proactive Monitoring: Security teams should monitor device logs for unusual process activity or attempts to access restricted kernel memory regions that may indicate exploitation.

Compensating Controls: Ensure that all applications are sourced from trusted app stores and maintain strict permission policies to limit the potential for malicious code to be executed on the local system.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the integrity and security of Android devices by allowing local escalation of privilege. Administrators and users should prioritize the deployment of the March 2026 security patches immediately to mitigate the risk of unauthorized system access.