CVE-2020-0041
Published 2020-03-10 · Updated 2026-06-17 · Source security@android.com
Summary
CVE-2020-0041 is a high-severity (CVSS 7.8) vulnerability in Android Android Kernel. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA does not currently list it as used in ransomware campaigns. Android has 17 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 17 known-exploited Android vulnerabilities →Description
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Android — Android Kernel
Name: Android Kernel Out-of-Bounds Write Vulnerability
Date added: 2021-11-03 · Due: 2022-05-03
Required action: Apply updates per vendor instructions.