EUVD-2026-37174
GHSA-98g9-5fpq-hx7c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Crafted RTP packet parsed remotely during a media session (AV:N, UI:R), no auth (PR:N); yields only a limited memory read (C:L) with no integrity or availability impact.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
AnalysisAI
An out-of-bounds read in Android's RTP media stack, specifically in RtpPacket::decodePacket, can leak a small amount of adjacent memory to a remote party that delivers a crafted RTP packet while the device is participating in a media or VoIP session. Exploitation requires no privileges (CVSS PR:N) but does require the victim to engage in the RTP session (UI:R), and the resulting impact is limited to partial confidentiality loss (C:L) with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is low at 0.18% (8th percentile); CISA SSVC rates exploitation as none and the issue as not automatable.
Technical ContextAI
RTP (Real-time Transport Protocol) is the UDP-based transport used to carry audio and video in VoIP, conferencing, and streaming applications; Android's media framework parses inbound RTP datagrams through RtpPacket::decodePacket. The root cause is classified as CWE-125 (Out-of-bounds Read), reached here via an integer overflow in the packet's length or offset arithmetic: the overflowed value causes a bounds check to be satisfied incorrectly, so the parser subsequently reads beyond the end of the received packet buffer. Only a small amount of adjacent memory is exposed (C:L) and scope is unchanged (S:U), meaning the bug does not let an attacker escape the parser's security context or gain code execution. The affected code ships in the Android platform RTP/media component, tracked under CPE cpe:2.3:a:google:android and disclosed by Google Devices through the Pixel security bulletin dated 2026-06-01; ENISA tracks it as EUVD-2026-37174.
RemediationAI
Vendor-released patch: patch available per the Android/Pixel security bulletin 2026-06-01 (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01) - apply the June 2026 Android security patch level to affected devices (Pixel builds and OEM builds that merge the corresponding platform fix), which removes the integer overflow in RtpPacket::decodePacket; no standalone patch version number is published in the supplied data, so rely on the bulletin's build list. Because the defect is only reachable inside an active RTP session, interim exposure reduction means avoiding or declining RTP/VoIP media sessions with untrusted peers on unpatched devices and preventing untrusted RTP streams from reaching the media stack where device policy allows, though the trade-off is loss of normal VoIP/conferencing functionality; network-level filtering of RTP traffic is impractical in most deployments because RTP uses dynamic, negotiated high UDP ports. Since exploitation needs user interaction (UI:R) and yields only a small information disclosure with no code execution or privilege gain, no emergency isolation action is warranted, but patching should be scheduled as routine maintenance. Confirm remediation via the device's Android security patch level rather than by CVE-specific detection, as no separate patch identifier is provided.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today