Google Pixel Out-of-Bounds Write Vulnerability

HIGH 7.8EXPLOITED (CISA KEV)CVE-2021-39793 · Published 16/03/2022 · updated 17/06/2026

Google Pixel Out-of-Bounds Write Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 11/04/2022. Patch affected systems as an emergency.

In short

CVE-2021-39793 is a HIGH (CVSS 7.8) vulnerability.
Exploited in the wild: CISA added it to the KEV catalog on 11/04/2022.
Chance of exploitation in the next 30 days (EPSS): 0.69%, higher than 52.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
Pixel Google	Versions not published yet (product named by CISA KEV)

Description

In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A

References

source.android.com/security/bulletin/pixel/2022-03-01 · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · Third Party Advisory
CISA KEV · CVE-2021-39793

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free