EUVD-2026-73960
GHSA-6cg4-96xx-xg28
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-delivered MKV content exploitable via low-privilege app or service channel with no user interaction required; full RCE impact within media process justifies C:H/I:H/A:H.
Primary rating from Vendor (android).
CVSS VectorVendor: android
Lifecycle Timeline
5DescriptionCVE.org
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Remote code execution in Android's MatroskaExtractor component (MatroskaExtractor.cpp) affects Android 14, 15, 16, and 16-qpr2 via an improper type cast during Matroska/MKV media container parsing. A low-privileged remote attacker can exploit this flaw without user interaction to achieve full confidentiality, integrity, and availability compromise on the target device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires low-privilege access (PR:L per CVSS) - the attacker must be able to deliver malicious Matroska/MKV content to the Android media framework, for example via an installed application, a media service callable by low-privilege processes, or a network-accessible media endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) characterizes a low-complexity, network-accessible vulnerability requiring only low privileges with no user interaction - a serious combination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Android Security Patch Level (SPL) dated 2026-09-01 or later, as documented in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/2026/2026-09-01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your organization's Android device inventory to identify Android 14, 15, 16, and 16-qpr2 deployments and document their exposure to media processing workflows. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-704 – Incorrect Type Conversion or Cast
View allShare
External POC / Exploit Code
Leaving vuln.today