CVE-2020-0041: Android kernel binder out-of-bounds write enables local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe vulnerability is a confirmed in-the-wild exploited local privilege escalation in the Android kernel, though exploitation requires local access and the EPSS probability is moderate.

What it is

The Android kernel binder driver (binder_transaction in binder.c) performs an incorrect bounds check, allowing an out-of-bounds write. A local attacker can exploit this to escalate privileges on the device without any user interaction. The flaw is in the Android kernel and was addressed in the March 2020 Android security bulletin.

Impact

An attacker with local access to the device gains kernel-level code execution, leading to full compromise of confidentiality, integrity and availability. This can be used to install persistent malware or bypass Android security controls.

Attack surface

Reached locally through the binder IPC interface, which is exposed to apps on the device. The CVSS vector (AV:L/PR:L/UI:N) indicates a local attacker with low privileges and no user interaction is required.

Exploitation

CVE-2020-0041 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming exploitation in the wild. EPSS gives a 30-day exploitation probability of 0.03246 (87.68th percentile), and no ransomware use is documented.

What to do

• Apply the Android March 2020 security bulletin kernel update or the vendor-provided patch for your device.
• Restrict installation of untrusted apps and enforce Google Play Protect to reduce the local attack surface.
• Keep Android devices updated to the latest available security patch level.
• For devices no longer receiving updates, consider replacing them or isolating them from sensitive data.
• Monitor for and remove apps that request unusual permissions or exhibit privilege-escalation behavior.

Detection

• Monitor kernel logs for binder transaction errors or out-of-bounds write indicators.
• Use Android security logging (e.g., SELinux denials, auditd) to detect anomalous binder calls from untrusted apps.
• Track device patch levels and flag devices missing the March 2020 Android security update.
• Correlate local privilege escalation attempts with suspicious app installations or root activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.