What is the CVSS score of CVE-2026-0149?

CVE-2026-0149 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google are affected by CVE-2026-0149?

Remote code execution vulnerability in Android and Pixel devices (CVE-2026-0149) enables compromise through malicious RTP/RTCP media calls, with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-0149?

Within 24 hours: Identify and document all Android and Pixel devices in your organization, prioritizing those used for calls or video conferencing, and issue guidance restricting media calling features pending remediation. Within 7 days: Implement network controls to segment media traffic, deploy endpoint management policies to disable non-essential media applications, and establish communication with mobile device manufacturers for patch timeline clarity. Within 30 days: Monitor Android and Pixel security bulletins for patch availability, develop a staged patching strategy prioritizing high-risk use cases, and verify remediation across your inventory once patches are released.

Google CVE-2026-0149

EUVD-2026-37183 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-16 Google_Devices

GHSA-97v7-8jc6-jvpq

RCE Buffer Overflow Google Heap Overflow

8.8

CVSS 3.1 · CISA-ADP

Severity by source

CISA-ADP PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from CISA-ADP · only source for this CVE.

CVSS VectorCISA-ADP

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:09 vuln.today

CVE Published

Jun 16, 2026 - 18:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 16, 2026 - 18:51 cve.org

HIGH 8.8

DescriptionCVE.org

In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Remote code execution in Android's RTP/RTCP media stack (RtpSession::rtpSendRtcpPacket) allows a remote peer to trigger a CWE-122 heap buffer overflow and gain arbitrary code execution within the affected media/telephony component without user interaction. Addressed in the June 2026 Android/Pixel security bulletin, the flaw carries total technical impact (SSVC) and CVSS 8.8, though CISA SSVC currently records exploitation status as 'none' and EPSS is low at 0.28% (19th percentile). No public exploit identified at time of analysis, and it is not listed in CISA KEV.