CVE-2026-0043: Integer Overflow
In multiple functions of ubsanthrowingruntime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict local access to systems that include the UBSan runtime (ubsan_throwing_runtime). Limit which accounts can log in or execute binaries on affected hosts (remove unneeded local accounts, enforce sudo/privilege restrictions), and apply host-based ACLs to prevent untrusted users from reaching those systems.
- Compensating control
Isolate affected hosts from untrusted networks and users using network segmentation, host firewalls, and access control lists. Block or limit management and local-access services to trusted admin networks only.
- Operational
Monitor and investigate signs of persistent denial-of-service and local privilege escalation on affected systems (review logs, crash reports, and unusual process behavior). If compromise is suspected, perform incident response actions such as isolating the host, rebuilding or restoring from known-good backups, and rotating any potentially exposed credentials.
- Operational
Apply vendor-supplied fixes or patches for the vulnerable UBSan runtime as soon as they are released; plan for prompt testing and deployment of updates to affected systems.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0043?
The severity of CVE-2026-0043 is medium with a score of 5.5 according to the CVSS 3.1 system.
What is the risk associated with CVE-2026-0043?
The risk associated with CVE-2026-0043 is classified as 32.
How do I fix CVE-2026-0043?
To fix CVE-2026-0043, you should apply the latest security updates provided for Google Android and llvm libubsan.
What vulnerabilities are present in CVE-2026-0043?
CVE-2026-0043 contains a vulnerability due to an integer overflow that can lead to persistent denial of service.
Is user interaction required to exploit CVE-2026-0043?
No, user interaction is not needed for the exploitation of CVE-2026-0043.