EUVD-2026-37191
GHSA-9968-j665-2mww
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable RTCP parser requires active session participation (PR:L); OOB read yields only partial memory disclosure with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Out-of-bounds read in Android's RTCP header parser (RtcpHeader::decodeRtcpHeader) exposes process memory to remote attackers with low-privilege network access. Affected Android devices parsing malformed RTCP packets may leak sensitive in-process data, constituting a remote information disclosure vulnerability. No public exploit identified at time of analysis; EPSS at 0.17% (6th percentile) and SSVC exploitation status of 'none' indicate low near-term exploitation likelihood despite the network-accessible attack surface.
Technical ContextAI
RTCP (Real-time Transport Control Protocol) is the companion control protocol to RTP, used in VoIP, video conferencing, and multimedia streaming to carry session statistics and control signals. The RtcpHeader::decodeRtcpHeader function in Android's media stack fails to perform adequate bounds checking when parsing incoming RTCP packet header fields, resulting in an out-of-bounds read (OOB read) of adjacent memory. The vendor-assigned CWE-120 (Buffer Copy without Checking Size of Input) identifies the root cause class as improper size validation; while CWE-120 is canonically associated with write overflows, the vendor confirms the exploitable outcome here is a read past allocated buffer boundaries, which can expose arbitrary memory contents to the attacker. The CPE string cpe:2.3:a:google:android:*:*:*:*:*:*:*:* uses a fully wildcarded version, indicating the Android application layer broadly is considered affected, with the EUVD entry EUVD-2026-37191 additionally referencing the Android kernel component.
RemediationAI
Apply the patches documented in the June 2026 Pixel Security Bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01) by updating to the 2026-06-01 Android security patch level or later. An exact patched version number is not independently confirmed from available data beyond the bulletin publication date. Pixel device users should apply the June 2026 monthly update via Settings > System > System update. For other Android OEMs, equivalent patches should be available through manufacturer-specific update channels once backported. As a compensating control in high-sensitivity environments, restricting or disabling RTCP-based media applications (VoIP clients, video conferencing apps) removes the attack surface entirely, though this eliminates legitimate real-time communication functionality. Network-level filtering of unsolicited RTCP traffic (UDP port 5005 and related ports) at the perimeter can reduce exposure for devices that do not need to receive RTCP from untrusted sources, with the trade-off of potentially disrupting legitimate media sessions.
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today