# CVE-2026-0142: Google Pixel Bootloader out of bounds read in iavb_parse_key_data

Source: https://junglewise.ai/threats/cve-2026-0142-google-pixel-bootloader-out-of-bounds-read-in-iavb-parse-key-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-0142 · Severity: info · CVSS 5.5 · Published 2026-06-16

A vulnerability in the Google Pixel bootloader could allow a local attacker to access sensitive information that should be protected. The bootloader is the critical software that starts the device and ensures its security; an exploit here could compromise the privacy of device data. This issue is resolved in the June 2026 security update for Pixel devices.

Technologies: [Google Pixel Bootloader](https://junglewise.ai/threats/technologies/pixel-bootloader). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-0142 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0142 being exploited in the wild.

**How severe is CVE-2026-0142?** Informational severity, with a CVSS score of 5.5, published 16 June 2026.

**Which products and versions are affected?** Google Pixel Bootloader Devices updated before June 2026 patch level.

**Is there a fix for CVE-2026-0142?** A patch was published on 2026-06-05: Security patch level date for fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0142 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-0142?** Check whether you run Google Pixel Bootloader at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the 'iavb_parse_key_data' function within 'avb_rsa.c' of the Google Pixel Bootloader. The flaw is caused by improper input validation during the parsing of RSA key data. A local attacker can exploit this to read sensitive memory contents without requiring additional execution privileges or user interaction. This vulnerability is tracked by Google as bug A-485031572 and was addressed in the June 2026 Pixel Update Bulletin.

## Affected products

- Google Pixel Bootloader Devices updated before June 2026 patch level

## Timeline

- 2026-06-16: disclosed: Published in the June 2026 Pixel Update Bulletin
- 2026-06-05: patched: Security patch level date for fix

## References

- [https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01](https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01)

## Related threats

- [Google Pixel Bootloader permission bypass via integer overflow](https://junglewise.ai/threats/cve-2026-56889-google-pixel-bootloader-permission-bypass-via-integer-overflow)
- [Google Pixel Bootloader permission bypass in remap.c](https://junglewise.ai/threats/cve-2026-56881-google-pixel-bootloader-permission-bypass-in-remap-c)
- [Google Pixel Bootloader out-of-bounds write in remap.c](https://junglewise.ai/threats/cve-2026-55365-google-pixel-bootloader-out-of-bounds-write-in-remap-c)
- [Google Pixel Bootloader out-of-bounds write in printf](https://junglewise.ai/threats/cve-2026-55317-google-pixel-bootloader-out-of-bounds-write-in-printf)
- [Google Pixel Bootloader privilege escalation in addr_remap_address_map](https://junglewise.ai/threats/cve-2026-55304-google-pixel-bootloader-privilege-escalation-in-addr-remap)