Google Android CVE-2026-0131

Exploitation requires local access with low existing privileges (PR:L) plus user interaction (UI:R) - the attacker must already be able to run code or act locally (e.g., a malicious or compromised app) and the victim must perform an action that reaches the vulnerable RTP decode path (RtpPacket::decodePacket). The specific triggering configuration or RTP source is not detailed in the available sources beyond the need to pass attacker-influenced data into decodePacket. Limiting factors: no remote network vector (AV:L), the mandatory user-interaction step, and the pre-requisite of an existing low-privilege local context all narrow realistic exploitation; there is no indication of automatable or unauthenticated exploitation.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3 HIGH) describes a locally-exploitable integer-overflow leading to out-of-bounds access in RtpPacket::decodePacket, requiring already-present low privileges plus user interaction, with total confidentiality/integrity/availability impact on the local component. The supporting signals point to low real-world urgency: EPSS is 0.07% (0th percentile), and the SSVC decision is Exploitation=none, Automatable=no, Technical Impact=total - meaning high impact if triggered but no observed exploitation and no mass-automation path (consistent with a local-only, UI-gated vector). This is not in CISA KEV and no exploit reference is present, so it reads as a high-impact-but-low-likelihood local privilege-escalation issue rather than an actively exploited emergency. The vuln.today 'this_week' label reflects routine Android-bulletin patch cadence, not active-exploitation pressure; the AV:L vector plus required user interaction materially limit practical risk. Note a minor data gap: the NVD CPE lists the Android application platform (cpe:2.3:a:google:android) while the EUVD 'affected versions' string says 'Android kernel' and the reference is the Pixel bulletin - verify the exact affected component/versions with the Android/Pixel security bulletin.

A low-privileged local app or logged-in user supplies a crafted RTP packet (e.g., via a media/telephony path) that triggers the integer overflow in RtpPacket::decodePacket, causing an out-of-bounds access that the attacker leverages to escalate privileges on the device. Because the CVSS vector requires user interaction (UI:R), the victim must perform some action (such as opening or accepting media content) for exploitation to succeed. No public exploit identified at time of analysis.