{"id":"CVE-2020-0041","published":"2020-03-10T20:15:21Z","modified":"2026-06-17T02:45:07Z","title":"Android Kernel Out-of-Bounds Write Vulnerability","vendor":"Android","product":"Android Kernel","tier":"core","eol":null,"description":{"text":"In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel","provenance":"source","from":"NVD"},"summary":{"text":"The Android kernel's binder_transaction function in binder.c contains an out-of-bounds write caused by an incorrect bounds check. An attacker with local access and low privileges, requiring no user interaction, can exploit it to escalate privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:13Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.03246,"percentile":0.8827,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0041","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-10-28","exploitedFirstSeen":"2021-10-28","ransomware":false,"evidence":[{"url":"https://www.lookout.com/threat-intelligence/article/lookout-discovers-global-rooting-malware-campaign","date":"2021-10-28"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://source.android.com/security/bulletin/2020-03-01","tags":["Vendor Advisory"]},{"url":"https://source.android.com/security/bulletin/2020-03-01","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0041","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local kernel bug exploited for privilege escalation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could lead to local escalation of privilege","start":114,"end":157}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-1548","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-1548","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":1,"earliest":"2020-03-31","earliestUrl":"https://github.com/bluefrostsecurity/CVE-2020-0041","repos":[{"name":"bluefrostsecurity/CVE-2020-0041","url":"https://github.com/bluefrostsecurity/CVE-2020-0041","stars":259,"created":"2020-03-31"},{"name":"j4nn/CVE-2020-0041","url":"https://github.com/j4nn/CVE-2020-0041","stars":64,"created":"2020-08-10"},{"name":"jcalabres/root-exploit-pixel3","url":"https://github.com/jcalabres/root-exploit-pixel3","stars":14,"created":"2023-08-29"},{"name":"vaginessa/CVE-2020-0041-Pixel-3a","url":"https://github.com/vaginessa/CVE-2020-0041-Pixel-3a","stars":9,"created":"2023-08-14"},{"name":"koharin/CVE-2020-0041","url":"https://github.com/koharin/CVE-2020-0041","stars":1,"created":"2021-09-10"}]},"first":{"date":"2020-03-31","source":"PoC-in-GitHub","url":"https://github.com/bluefrostsecurity/CVE-2020-0041"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2020-03-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-0041","provenance":"source"},{"date":"2020-03-31","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/bluefrostsecurity/CVE-2020-0041","provenance":"source"},{"date":"2021-10-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.lookout.com/threat-intelligence/article/lookout-discovers-global-rooting-malware-campaign","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-1548","provenance":"source"}],"speed":{"daysToPublicExploit":21,"firstExploitFrom":"PoC-in-GitHub","daysToKev":603},"priority":{"score":66.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1827 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.65,"detail":"percentile 0.8827"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}