CVE-2026-0142: Input Validation
In iavbparsekeydata of avbrsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Limit local exposure of the code path that calls iavb_parse_key_data in avb_rsa.c. Prevent untrusted or low-privilege local users/processes from supplying AVB RSA key data (for example by tightening filesystem permissions, local ACLs, containerization, or host-based access controls) so that only trusted principals can provide inputs to the parser.
- Operational
Add or enforce input validation and sanity checks on AVB RSA key data before invoking iavb_parse_key_data (avb_rsa.c): validate lengths and bounds and reject malformed key data to avoid out-of-bounds reads. Audit systems that process such key data for signs of information disclosure and investigate any suspicious access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0142?
The severity of CVE-2026-0142 is classified as low, with a score of 3.3.
What does CVE-2026-0142 affect?
CVE-2026-0142 affects Google libavb and Google Android systems.
What kind of vulnerability is CVE-2026-0142?
CVE-2026-0142 is an input validation vulnerability that may lead to local information disclosure.
How do I mitigate CVE-2026-0142?
To mitigate CVE-2026-0142, ensure that you apply the latest security updates provided by Google for libavb and Android.
Can CVE-2026-0142 be exploited without user interaction?
Yes, CVE-2026-0142 can be exploited without any user interaction required.