EUVD-2026-37194
GHSA-wx93-g978-mh3j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish RTP/RTCP media session with target
-
DeliverySend crafted RTCP report-block count
-
ExploitTrigger integer overflow in RtpSession.cpp
-
ExecutionOut-of-bounds write corrupts heap
-
ImpactEscalate privilege in media/system process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to deliver crafted RTP/RTCP report-block traffic to Android's native RtpSession parser - in practice, being the remote peer in an active RTP media session (VoIP/VoLTE/IMS call or streaming session) so the malicious RTCP receiver report reaches numberOfReportBlocks handling. No user interaction is needed once such traffic is processed (UI:N). Limiting factors: the RTP stack/feature must be in use and reachable, the CVSS PR:L indicates some privilege or session context is required (not confirmed as fully anonymous despite the 'no additional privileges' wording), SSVC rates it non-automatable, and only devices below the 2026-06-01 patch level are affected. |
| Impact | Signals are mixed and lean toward a real-but-not-urgent priority. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, total C/I/A impact) and SSVC 'Technical Impact: total' reflect severe consequences if triggered, but the corroborating exploitation signals are weak: EPSS is only 0.23% (13th percentile), SSVC marks Exploitation as 'none' and Automatable as 'no', there is no KEV listing, and no public PoC. The 'Automatable: no' rating is consistent with the fact that reaching the parser typically requires an active RTP/RTCP media session rather than spray-and-pray internet scanning. One point to verify: the description frames this as 'remote escalation of privilege with no additional execution privileges needed,' which reads like unauthenticated triggering, yet the CVSS carries PR:L - this tension suggests the attacker must already be a participant in a media session (or a local low-priv context) rather than a fully anonymous remote party; confirm the exact reachability with Google's bulletin. Net: patch on the normal Android monthly cadence; not an emergency given no exploitation evidence. |
| Exploit ScenarioDerived | An attacker who can send RTP/RTCP traffic to a target device (for example as the remote peer in a VoIP/IMS call or a malicious media server) crafts an RTCP receiver-report packet with a report-block count chosen to trigger the integer overflow. When RtpSession.cpp processes it, the overflowed length calculation causes an out-of-bounds write in the media/system process, corrupting memory to escalate privilege with no user interaction. No public exploit is identified at time of analysis, and the low SSVC/EPSS ratings indicate exploitation would require non-trivial development effort. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Out-of-bounds heap write in Android's native RTP stack (numberOfReportBlocks handling in RtpSession.cpp) allows a network-adjacent attacker to corrupt memory and achieve remote escalation of privilege without user interaction. The flaw stems from an integer overflow when counting RTCP report blocks, and it affects Android/Pixel builds prior to the June 2026 security patch level. There is no public exploit identified at time of analysis, EPSS risk is low (0.23%), and CISA has not listed it in KEV.
RemediationAI
Patch available per vendor advisory: update affected devices to the Android 2026-06-01 security patch level or later as delivered through Google's monthly OTA updates, following the Pixel Update Bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01. No exact fixed OS build number is provided in the source data, so treat the June 2026 patch level as the fix boundary and confirm per-device availability with the OEM. Where immediate patching is not possible, reduce exposure to untrusted RTP/RTCP traffic: avoid answering VoIP/IMS calls from unknown parties, disable or restrict Wi-Fi Calling / VoLTE features that instantiate the native RTP session on untrusted networks, and use network filtering to limit inbound RTP/RTCP to trusted SIP/media gateways - noting the trade-off that these controls degrade or disable calling functionality.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable code lives in RtpSession.cpp, part of Android's native Real-time Transport Protocol implementation used for VoIP/IMS calling and media streaming. RTCP (the control channel companion to RTP) receiver-report packets carry a report-block count field; the numberOfReportBlocks value is used in a size/index calculation that overflows an integer, so a subsequent bounds check passes and the code writes past the end of the allocated buffer. This is a classic CWE-787 (Out-of-bounds Write) rooted in a CWE-190-style integer overflow. Per the CPE (cpe:2.3:a:google:android), the affected surface is the Android platform itself rather than a third-party app, meaning the bug sits in a system/media process context where corruption can yield privilege escalation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Reachable over the network via RTCP within a media session (AV:N, PR:L for session/low-priv context, UI:N); memory-corruption EoP yields total C/I/A in an unchanged scope.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
2DescriptionCVE.org
In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android and Pixel devices across the organization face a critical compromise risk through a remote privilege escalation vulnerability (CVE-2026-0161) with no public exploit identified at time of analysis. Complete device takeover is possible, threatening business operations and sensitive data access; an immediate inventory and remediation plan are essential.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Network segmentation to restrict RTCP traffic from untrusted networks; (2) Disable RTP/RTCP services where not operationally required; (3) Enhanced network monitoring for suspicious RTCP activity patterns; (4) Restrict device connectivity to managed, trusted networks; (5) Weekly monitoring of vendor security advisories for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB