CVE-2021-39793
Published: April 11, 2022
Official Description
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
CISA KEV Advisory
Google Pixel Out-of-Bounds Write Vulnerability
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
Apply updates per vendor instructions.
Risk Analysis
This high-severity vulnerability in Google Pixel devices involves an out-of-bounds write due to a logic error, potentially leading to local escalation of privilege. The confirmed exploitation by CISA (is_in_kev: true) makes this a critical concern for device security. The low EPSS score of 0.00092 is overridden by the confirmed in-the-wild exploitation.
Active exploitation of this vulnerability has been observed in the wild. This means attackers are currently leveraging this flaw to gain elevated privileges.
Install the latest security updates and patches for Google Pixel devices. Ensure all system and application software is kept up-to-date to prevent exploitation of privilege escalation flaws.
Technical Analysis
CVE-2021-39793 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2021-39793 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2021-39793 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1