In ns_GetUserData of ns_SmscbUtilities

The bug is an out-of-bounds write in ns_GetUserData inside ns_SmscbUtilities.c, a telephony/baseband-facing parser path associated with cellular messaging utilities. In practical terms, the affected population is not all Android devices on the internet; Google's own March 2026 Pixel bulletin places CVE-2026-0111 in the Cellular Modem and rates it High, so the real exposure is unpatched Pixel devices carrying the vulnerable modem firmware before the March 2026 security update level.

The generic 9.8/AV:N label overstates enterprise risk because it treats 'network' like routable internet reachability. Here, the attacker path is the cellular radio stack, which usually implies rogue base-station proximity, carrier/signaling access, or similarly specialized positioning; that sharply narrows who can actually exploit it at scale even though the underlying bug class is dangerous.

Why this verdict

• Attacker position knocks this down: 'AV:N' is technically true in a broad sense, but in practice the attacker needs rogue base-station proximity, SDR infrastructure, or telecom-path access rather than normal internet reachability.
• Population is narrower than the headline implies: Google's Pixel bulletin classifies this as a High EoP in Cellular Modem, not a universal Android framework/server issue.
• Threat intel is quiet: no KEV listing, low EPSS, and no public PoC materially reduce urgency versus a widely exploited internet-facing 9.8.

Why not higher?

I am not calling this CRITICAL because the exploit chain starts with a specialized radio-path prerequisite that most enterprise attackers do not possess at scale. The lack of public exploitation evidence and the absence of a public end-to-end chain keep this out of the 'drop everything' bucket for a 10,000-device fleet.

Why not lower?

I am not dropping this to MEDIUM because the underlying primitive is still pre-auth, no-click memory corruption in a cellular modem path. If you do have a materially exposed Pixel fleet, especially executives or travel-heavy staff, the impact of a successful exploit is serious and preventive visibility is poor.

1. Enforce a minimum security patch level — Use MDM to require Android security patch level 2026-03-05 or later on Pixel devices and block stale devices from sensitive access. For a HIGH verdict, deploy this control within 30 days if patch rollout is lagging.
2. Disable legacy cellular exposure where supported — Disable 2G fallback and other legacy radio modes through carrier/MDM policy where the platform and region allow it, because rogue-base-station attacks get easier as the radio stack gets older and weaker. Treat this as a risk-reduction step to deploy within 30 days.
3. Quarantine unpatched high-risk users — Prioritize executives, traveling staff, journalists, legal, and administrators who carry Pixel handsets and spend time in uncontrolled radio environments. If they cannot be patched promptly, remove them from high-trust mobile access paths within 30 days.
4. Watch for telephony instability — Collect and review crash telemetry, modem resets, and anomalous cellular-service failures from your mobile fleet or carrier/mobile-threat-defense stack. This will not stop exploitation, but it helps identify suspicious activity while you complete remediation within 30 days.

Run this on an auditor workstation that has Android platform-tools/adb installed and can query a managed device over USB or approved remote debugging. Invoke it as python3 check_cve_2026_0111.py --serial ABC123456 or without --serial for the only attached device; no root is required, but the device must be reachable by adb.

#!/usr/bin/env python3
"""
check_cve_2026_0111.py

Checks whether an attached Android device is likely exposed to CVE-2026-0111
based on vendor scope and security patch level.

Logic:
- If the device is not Google/Pixel -> UNKNOWN (official public scope here is Pixel Cellular Modem)
- If Android security patch level >= 2026-03-05 -> PATCHED
- If Android security patch level < 2026-03-05 -> VULNERABLE
- If required properties cannot be read -> UNKNOWN

Exit codes:
0 = PATCHED
1 = VULNERABLE
2 = UNKNOWN / error
"""

import argparse
import datetime as dt
import subprocess
import sys

PATCH_FLOOR = dt.date(2026, 3, 5)


def run_adb(args, serial=None):
    cmd = ["adb"]
    if serial:
        cmd += ["-s", serial]
    cmd += args
    try:
        res = subprocess.run(cmd, capture_output=True, text=True, timeout=20)
    except FileNotFoundError:
        print("UNKNOWN - adb not found in PATH")
        sys.exit(2)
    except subprocess.TimeoutExpired:
        print("UNKNOWN - adb command timed out")
        sys.exit(2)

    if res.returncode != 0:
        stderr = (res.stderr or "").strip()
        print(f"UNKNOWN - adb failed: {stderr or 'unknown error'}")
        sys.exit(2)
    return (res.stdout or "").strip()


def getprop(prop, serial=None):
    return run_adb(["shell", "getprop", prop], serial=serial).strip()


def parse_date(value):
    try:
        return dt.datetime.strptime(value, "%Y-%m-%d").date()
    except Exception:
        return None


def main():
    parser = argparse.ArgumentParser(description="Check likely exposure to CVE-2026-0111 on a connected Android device")
    parser.add_argument("--serial", help="ADB device serial", default=None)
    args = parser.parse_args()

    # Basic connectivity check
    state = run_adb(["get-state"], serial=args.serial)
    if state.strip() != "device":
        print(f"UNKNOWN - adb state is '{state.strip()}', not 'device'")
        sys.exit(2)

    manufacturer = getprop("ro.product.manufacturer", serial=args.serial)
    brand = getprop("ro.product.brand", serial=args.serial)
    model = getprop("ro.product.model", serial=args.serial)
    device = getprop("ro.product.device", serial=args.serial)
    patch = getprop("ro.build.version.security_patch", serial=args.serial)

    patch_date = parse_date(patch)
    vendor_text = " ".join([manufacturer, brand, model, device]).lower()
    is_google_pixel = ("google" in vendor_text) or ("pixel" in vendor_text)

    if not patch or patch_date is None:
        print(f"UNKNOWN - could not parse security patch level (value: '{patch}') for {manufacturer} {model}")
        sys.exit(2)

    if not is_google_pixel:
        print(f"UNKNOWN - device is '{manufacturer} {model}' with patch level {patch}; public authoritative scope reviewed here is Pixel Cellular Modem")
        sys.exit(2)

    if patch_date >= PATCH_FLOOR:
        print(f"PATCHED - {manufacturer} {model} security patch level {patch} meets or exceeds {PATCH_FLOOR.isoformat()}")
        sys.exit(0)
    else:
        print(f"VULNERABLE - {manufacturer} {model} security patch level {patch} is older than {PATCH_FLOOR.isoformat()}")
        sys.exit(1)


if __name__ == "__main__":
    main()

Sources

1. Android Security Bulletin—March 2026
2. Pixel Update Bulletin—March 2026
3. CVE Record
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS
6. Check & update your Android version
7. Google Play Protect on-device protections
8. srsRAN Project documentation