EUVD-2026-37197
GHSA-42ch-w3xc-h9xw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Network-delivered RTCP exploit requires low session privilege and victim interaction; read-only OOB flaw yields no integrity or availability impact.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
AnalysisAI
Out-of-bounds memory read in Android's RTCP packet decoder exposes sensitive process memory to remote attackers, resulting in information disclosure with high confidentiality impact. Affected are Android devices (Google-reported, Pixel bulletin coverage) where a low-privileged network peer can trigger the flaw via a maliciously crafted RTCP stream, contingent on victim user interaction. No public exploit code exists and SSVC rates exploitation as none at time of analysis, keeping real-world risk moderate despite the C:H CVSS rating.
Technical ContextAI
RTCP (Real-time Control Protocol, RFC 3550) is the companion control protocol to RTP, used in Android for multimedia streaming, VoIP, and video call sessions. The affected code resides in several functions of Android's RTCP packet decoder, where missing bounds checks on packet field parsing (CWE-125: Out-of-bounds Read) allow a crafted packet to cause the decoder to read memory beyond the intended buffer boundary. This class of flaw typically arises when packet length fields are trusted without validation against the actual allocated buffer size. The CPE string cpe:2.3:a:google:android:*:*:*:*:*:*:*:* indicates the issue is present across the Android application layer. The EUVD references this as affecting the Android kernel-level media stack component.
RemediationAI
Patch available per vendor advisory in the Google Pixel Security Bulletin dated 2026-06-01, available at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01. Users should apply the June 2026 Android security patch level or later as distributed by their device OEM. An exact patched version number is not independently confirmed from the available data beyond the bulletin reference. As a compensating control pending patch application, restricting or disabling media-streaming and VoIP applications that process external RTCP streams reduces attack surface; however this may impact communications functionality. Avoiding untrusted media sessions (e.g., answering calls from unknown sources) limits exploitation opportunity given the UI:R requirement.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today