What is the CVSS score of CVE-2026-0160?

CVE-2026-0160 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Android ImsMedia are affected by CVE-2026-0160?

CVE-2026-0160 is a high-severity remote code execution vulnerability in Android's ImsMedia stack affecting all Android and Pixel devices supporting IMS Real-Time Text (RTT) calling.

How to fix or mitigate CVE-2026-0160?

Within 24 hours, inventory all Android and Pixel devices in your organization and identify which have IMS RTT functionality enabled, assessing exposure based on device roles and network positioning. Within 7 days, implement interim compensating controls including disabling IMS RTT on devices where real-time text is not operationally required, deploying network-level RTP traffic inspection and filtering, and configuring Mobile Device Management (MDM) policies to restrict IMS calling capabilities where feasible. Within 30 days, establish formal monitoring for vendor patches from Google and Android security advisories, prepare a deployment plan for when patches become available (target deployment within 48 hours of patch release), and conduct risk-based prioritization of at-risk devices.

Android ImsMedia CVE-2026-0160

EUVD-2026-37193 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-16 Google_Devices

GHSA-5643-644w-q8gh

RCE Buffer Overflow Google

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-delivered RTP but requires an active negotiated RTT session (AC:H); attacker needs no device credentials (PR:N) and no user interaction, with total code-execution impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 23:07 vuln.today

CVE Published

Jun 16, 2026 - 18:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 16, 2026 - 18:51 cve.org

HIGH 8.8

DescriptionCVE.org

In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Remote code execution in Android's ImsMedia native stack stems from a missing bounds check in TextRtpPayloadDecoderNode::DecodeT140, where a crafted T.140 real-time text RTP payload triggers an out-of-bounds write (CWE-120). Any Android/Pixel device processing malicious RTP during an IMS RTT session can be compromised with no user interaction and, per the description, no additional execution privileges. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and SSVC records exploitation as none, indicating no observed in-the-wild activity despite total technical impact.

Technical ContextAI

The flaw lives in Android's ImsMedia library, the native media plane for IMS/VoLTE telephony that handles RTP payloads negotiated over SIP. TextRtpPayloadDecoderNode specifically decodes T.140 Real-Time Text (RTT), the standardized RFC 4103 payload for character-by-character text transmitted alongside voice calls. DecodeT140 parses attacker-controllable length/redundancy fields from incoming RTP packets and copies data into a fixed buffer without validating the size, so an oversized or malformed T.140 unit produces a classic buffer overflow (CWE-120, Buffer Copy without Checking Size of Input). Because this code runs in the native media process, memory corruption can be steered toward arbitrary code execution. The CPE cpe:2.3:a:google:android:*:*:*:*:*:*:*:* scopes the issue to Google's Android, with the fix delivered through the Pixel security bulletin.

RemediationAI

Apply the Android/Pixel security update that carries the 2026-06-01 (or later) security patch level as described in the vendor advisory (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01) - this is the primary fix; an exact fixed OS build/version is not enumerated in the provided data, so treat 'patch available per vendor advisory' as the status and confirm the patched build for your device fleet. Where updates cannot be applied immediately, reduce exposure by disabling Real-Time Text (RTT) in the phone/dialer accessibility settings so the T.140 decode path is not exercised, at the trade-off of losing RTT accessibility for hearing/speech-impaired users; carriers and MDM can also restrict or disable RTT provisioning in the IMS/VoLTE profile. Network-side, operator IMS core filtering of malformed RTP/T.140 payloads adds defense but is outside end-user control and does not substitute for the OS patch.