EUVD-2026-73960
GHSA-6cg4-96xx-xg28
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Matroska/MKV media file
-
DeliveryDeliver to Android media framework via low-privilege app or service channel
-
ExploitTrigger improper type cast in MatroskaExtractor read()
-
ExecutionWrite out-of-bounds into media process memory
-
ImpactExecute arbitrary code within media parsing process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Correct type conversion
|
| Exploitation Conditions | Requires low-privilege access (PR:L per CVSS) - the attacker must be able to deliver malicious Matroska/MKV content to the Android media framework, for example via an installed application, a media service callable by low-privilege processes, or a network-accessible media endpoint. The description states no user interaction is required once the crafted content is parsed, and no additional execution privileges beyond the media parser process context are needed. Exploitation is limited to Android 14, 15, 16, and 16-qpr2 on devices without the September 2026 security patch. No special device configuration or non-default feature flag is identified as a prerequisite in the available data. |
| Impact | CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) characterizes a low-complexity, network-accessible vulnerability requiring only low privileges with no user interaction - a serious combination. However, EPSS at 0.15% (5th percentile) and the absence of a CISA KEV listing or known POC substantially temper immediate exploitation urgency. The PR:L metric indicates some authenticated or app-context access is required, distinguishing this from a fully unauthenticated drive-by attack. The UI:N metric is the more consequential signal: once malicious MKV content reaches the parser, no further victim action is needed. Historical precedent with Android media-parsing vulnerabilities demonstrates these can be weaponized effectively, but low EPSS suggests no active exploiter interest at time of analysis. Priority should be elevated for enterprise fleets and consumer devices that process untrusted third-party media. |
| Exploit ScenarioDerived | An attacker with low-privilege access - via a malicious installed app, a network-accessible media service, or a crafted media stream - delivers a specially crafted MKV file to a vulnerable Android device. The malformed Matroska container triggers an improper type cast in MatroskaExtractor's read() function, producing an out-of-bounds memory write that enables arbitrary code execution within the media parsing process. No user interaction is required once the crafted content is processed by the media framework. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Remote code execution in Android's MatroskaExtractor component (MatroskaExtractor.cpp) affects Android 14, 15, 16, and 16-qpr2 via an improper type cast during Matroska/MKV media container parsing. A low-privileged remote attacker can exploit this flaw without user interaction to achieve full confidentiality, integrity, and availability compromise on the target device. No public exploit has been identified at time of analysis, and EPSS stands at 0.15%, though the zero-interaction requirement and full-impact CVSS 8.8 rating warrant prompt patching.
RemediationAI
Apply the Android Security Patch Level (SPL) dated 2026-09-01 or later, as documented in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-09-01. OEM device manufacturers must integrate and distribute this patch via over-the-air updates; end users should navigate to Settings > Security > Security patch level and apply any pending updates. As a compensating control where patching is delayed, restrict or disable applications that auto-process untrusted Matroska/MKV media from unknown or unvetted sources, noting this may degrade media functionality. Enterprise MDM solutions can enforce minimum SPL compliance and block side-loaded or unverified media-handling applications. No exact patched build number beyond the 2026-09-01 patch level date was specified in the advisory.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MatroskaExtractor.cpp is Android's media framework component responsible for parsing Matroska/MKV container files, operating within Android's media pipeline (historically libstagefright or its successors). CWE-704 (Incorrect Type Conversion or Cast) identifies the root cause: an improper cast in the read() function misrepresents data size or signedness, causing a subsequent out-of-bounds memory write - effectively converging with CWE-787. This vulnerability class in media parsers is historically severe on Android; the 2015 Stagefright bug family exploited analogous media-parsing flaws to achieve silent, zero-click RCE. Affected versions per EUVD-2026-73960 span Android 14, 15, 16, and 16-qpr2, covering multiple active release trains simultaneously.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-delivered MKV content exploitable via low-privilege app or service channel with no user interaction required; full RCE impact within media process justifies C:H/I:H/A:H.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
3DescriptionCVE.org
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android 14, 15, 16, and 16-qpr2 devices face remote code execution through media file processing in the MatroskaExtractor component, enabling full device compromise without user interaction. Organizations operating Android fleets must assume all devices running these versions are potentially vulnerable pending a security update, as no patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or disable Matroska/MKV file handling in media applications where business operations permit; enforce content filtering to block MKV downloads from untrusted sources; limit media app permissions and network access on critical devices; monitor Android security bulletins (security.android.com) for vendor patches targeting CVE-2026-28609 and deploy immediately upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB