EUVD-2026-37213
GHSA-9fgj-4672-x862
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
RTCP packets arrive over the network (AV:N) during a user-initiated media session (UI:R), no auth (PR:N); a bounded heap OOB read leaks limited memory (C:L, I:N, A:N).
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
AnalysisAI
Out-of-bounds heap read in Android's RTCP parser (RtcpChunk::decodeRtcpChunk) can disclose limited process memory to a remote media peer when the user participates in an RTP/RTCP media session such as a VoIP, video call, or streaming session. The issue is a heap buffer overflow (CWE-122) that requires user interaction (UI:R) and no authentication (PR:N), but only yields low confidentiality impact with no integrity or availability impact, no code execution, and no public exploit identified; EPSS is 0.17% and CISA SSVC indicates no exploitation.
Technical ContextAI
RTCP (RTP Control Protocol) runs alongside RTP to carry control packets such as sender/receiver reports in real-time media sessions. In Android's media/telephony stack, RtcpChunk::decodeRtcpChunk parses attacker-controlled compound RTCP chunks; a heap-based buffer overflow (CWE-122) allows the parser to read past the end of a heap buffer instead of staying within bounds. The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* identifies Google Android as the affected platform, and EUVD lists the Android kernel as the affected component context. Because the defect results in an out-of-bounds read, the direct impact is limited to remote information disclosure (C:L) rather than code execution or memory corruption with write primitives. Exploitation requires the target to engage in an RTP/RTCP session, consistent with CVSS AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.
RemediationAI
Patch status: Patch available per vendor advisory (Android Security Bulletin). Apply the Android security update associated with the June 2026 Pixel/Android bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01; the provided data identifies a vendor advisory but does not give an exact patched build or version number, so use the latest available security patch level for the device. If immediate patching is not possible, reduce exposure to untrusted RTP/RTCP media by accepting calls or media sessions only from trusted peers and avoiding untrusted VoIP/video/streaming sessions, which is the same user-interaction precondition the flaw requires; blocking RTCP broadly is not practical for normal calling and would break real-time media quality reporting. Because exploitation needs the victim to engage in a media session and only permits a bounded heap read, compensating controls should focus on timely platform patching and peer trust rather than network-level RTCP filtering.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today