EUVD-2026-37178
GHSA-wr7c-vw79-c39c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Accept vendor DoS-only shape (C:N/I:N/A:H) as A:H is justified; keep AV:N/PR:N per vendor but note AoC is an on-device codec, so AV:L (~6.2) is plausible if reachability is local-only.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
A missing bounds check in the writeAocCommand routine of AocAudioCodec.cpp on Google Pixel devices using the Tensor Always-on Compute (AoC) audio subsystem can be driven by unauthenticated remote input to corrupt memory and crash the audio codec, yielding a denial of service with no user interaction required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only). The exposure is confined to Pixel/Tensor hardware running firmware prior to the 2026-06-01 Pixel patch level rather than all Android devices, even though the CPE is broad. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is low at 0.25% (16th percentile); the affected code path sits inside an on-device codec, so real-world remote reachability remains unconfirmed despite the AV:N vector.
Technical ContextAI
The flaw is a classic buffer overflow (CWE-120 - buffer copy without checking input size) in writeAocCommand within AocAudioCodec.cpp, the audio codec component of Google Tensor's Always-on Compute subsystem on Pixel devices. writeAocCommand processes audio-related command data and copies it without validating length against the destination buffer, so oversized or malformed input can overrun memory and destabilize the AoC firmware path. The CPE cpe:2.3:a:google:android:* and EUVD's affected-version listing (Android Android kernel) are broad and do not reflect the hardware-specific reality: the vulnerable code lives on Pixel/Tensor silicon, and the CVSS vector marks network reachability with no privileges or user interaction, yet because the component is an on-device audio codec, the practical remote trigger path is unconfirmed. Impact is availability-only (C:N/I:N/A:H) - no data disclosure or code execution is assessed - and SSVC rates automatable exploitation as 'no' with partial technical impact.
RemediationAI
Apply the Google Pixel security update for the 2026-06-01 patch level (patch available per vendor advisory at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01), which remediates the missing bounds check in writeAocCommand of AocAudioCodec.cpp; devices should be updated to that build or later, and administrators managing fleets should verify the June 2026 Pixel patch level is installed. Because the flaw is availability-only and locked to Pixel/Tensor AoC firmware, there is no network-facing configuration toggle that eliminates it; the practical compensating control is to limit exposure of audio input surfaces and disable always-on/voice-trigger audio features where the device supports it - with the trade-off that those features become unavailable - and to prioritize patching Pixel devices that process untrusted audio or media. Blocking ports is not applicable here since the vulnerable path is internal to the AoC subsystem, so patching remains the only reliable fix.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today