What is the CVSS score of CVE-2026-0161?

CVE-2026-0161 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Android are affected by CVE-2026-0161?

Android and Pixel devices across the organization face a critical compromise risk through a remote privilege escalation vulnerability (CVE-2026-0161) with no public exploit identified at time of…

How to fix or mitigate CVE-2026-0161?

Within 24 hours, conduct a comprehensive inventory of all Android and Pixel devices across the organization, documenting their security patch levels and network connectivity patterns. Over the next 7 days, implement interim protective measures including network segmentation to restrict RTCP traffic from untrusted sources, disable RTP/RTCP services where operationally unnecessary, and communicate the vulnerability and active controls to stakeholders. Within 30 days, establish a weekly vendor advisory monitoring process, coordinate with device manufacturers for patch timelines, and prepare an expedited deployment plan for immediate application once vendor patches become available.

Android CVE-2026-0161

EUVD-2026-37194 HIGH

Out-of-bounds Write (CWE-787)

2026-06-16 Google_Devices

GHSA-wx93-g978-mh3j

Privilege Escalation Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Google_Devices

Severity by source

Vendor (Google_Devices) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Reachable over the network via RTCP within a media session (AV:N, PR:L for session/low-priv context, UI:N); memory-corruption EoP yields total C/I/A in an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Google_Devices).

CVSS VectorVendor: Google_Devices

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:36 vuln.today

CVE Published

Jun 16, 2026 - 18:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 16, 2026 - 18:51 cve.org

HIGH 8.8

DescriptionCVE.org

In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Out-of-bounds heap write in Android's native RTP stack (numberOfReportBlocks handling in RtpSession.cpp) allows a network-adjacent attacker to corrupt memory and achieve remote escalation of privilege without user interaction. The flaw stems from an integer overflow when counting RTCP report blocks, and it affects Android/Pixel builds prior to the June 2026 security patch level. There is no public exploit identified at time of analysis, EPSS risk is low (0.23%), and CISA has not listed it in KEV.

Technical ContextAI

The vulnerable code lives in RtpSession.cpp, part of Android's native Real-time Transport Protocol implementation used for VoIP/IMS calling and media streaming. RTCP (the control channel companion to RTP) receiver-report packets carry a report-block count field; the numberOfReportBlocks value is used in a size/index calculation that overflows an integer, so a subsequent bounds check passes and the code writes past the end of the allocated buffer. This is a classic CWE-787 (Out-of-bounds Write) rooted in a CWE-190-style integer overflow. Per the CPE (cpe:2.3:a:google:android), the affected surface is the Android platform itself rather than a third-party app, meaning the bug sits in a system/media process context where corruption can yield privilege escalation.

RemediationAI

Patch available per vendor advisory: update affected devices to the Android 2026-06-01 security patch level or later as delivered through Google's monthly OTA updates, following the Pixel Update Bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01. No exact fixed OS build number is provided in the source data, so treat the June 2026 patch level as the fix boundary and confirm per-device availability with the OEM. Where immediate patching is not possible, reduce exposure to untrusted RTP/RTCP traffic: avoid answering VoIP/IMS calls from unknown parties, disable or restrict Wi-Fi Calling / VoLTE features that instantiate the native RTP session on untrusted networks, and use network filtering to limit inbound RTP/RTCP to trusted SIP/media gateways - noting the trade-off that these controls degrade or disable calling functionality.