EUVD-2026-37175
GHSA-4fww-63gw-28hw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote RTCP packet triggers a bounded OOB read with no interaction, yielding limited confidentiality only (C:L) and no integrity or availability impact.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
An out-of-bounds read in Android's RTCP APP packet decoder (decodeAppPacket in RtcpAppPacket.cpp) allows a remote party to a media session to read a limited amount of adjacent memory and disclose that information, with no code execution, integrity, or availability impact. Affected are Android/Pixel builds prior to the 2026-06-01 security patch level; the flaw is remotely reachable without authentication and without user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, confidentiality impact Low only), though the practical precondition is that the attacker be a participant in, or able to inject packets into, an active RTP/RTCP media session handled by the vulnerable parser. There is no CISA KEV entry, no publicly available exploit code identified at time of analysis, and EPSS is only 0.20% (9th percentile), so exploitation likelihood is very low despite the network attack vector.
Technical ContextAI
The vulnerability lives in Android's RTP/RTCP media stack, specifically the decoder for RTCP APP (application-defined) packets implemented in RtcpAppPacket.cpp. RTCP is the control protocol that accompanies RTP in VoIP/media sessions, and APP packets carry vendor- or application-defined payloads following a fixed header and a variable-length name field. The parser's decodeAppPacket routine reads length-derived fields from the incoming packet without validating them against the actual received buffer size, which is the classic root cause of CWE-125 (Out-of-bounds Read). Per the CPE data (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*) and the EUVD entry listing "Android Android kernel," the affected component is the Android platform stack shipped on Pixel and other Android builds, reported by Google Devices as part of the June 2026 Android/Pixel security bulletin. Because the read is bounded and informational only, SSVC rates technical impact as partial and automatable as no, and the CVSS vector shows no scope change and no integrity or availability effect.
RemediationAI
The primary fix is to apply the Android/Pixel 2026-06-01 security patch level (vendor-released patch, per the bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01); devices carrying that build or later are remediated, and no tagged upstream commit was supplied in the input data. Until devices can be updated, compensating controls must target reachability of the RTCP parser rather than the parser itself: block or tightly filter inbound RTP/RTCP media traffic on the negotiated UDP ports at network boundaries and on the device, which limits exposure but will break legitimate VoIP and real-time media applications that rely on those flows; segment or isolate devices that must participate in untrusted media sessions from sensitive networks, accepting the operational cost of reduced collaboration functionality; and avoid joining media sessions with untrusted participants until patched. Because the impact is confined to a bounded out-of-bounds read with no code execution, integrity, or availability effect, and because there is no public exploit identified and EPSS is 0.20%, patching on the normal monthly cycle is a reasonable posture; aggressive blocking of all RTCP traffic is a disproportionately disruptive mitigation for this severity level.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today