Google Android CVE-2026-59007

Exploitation requires the affected device to decode an attacker-crafted Vorbis audio stream whose codebook data triggers the logic error in decode_packed_entry_number (codebook.c); the vulnerable path is the Vorbis/Tremor codebook decoder reachable when the system processes such audio. Per the vendor CVSS vector the attack is network-reachable, unauthenticated (PR:N), and needs no user interaction (UI:N). Limiting factors that reduce real-world severity: impact is restricted to low-confidentiality information disclosure (C:L) with no integrity or availability effect and no code execution, so the attacker gains leaked memory contents rather than control; affected scope is Android 14 through 17. The precise content-delivery path that causes the device to decode the malicious stream is not described in the available sources.

Signals are consistent and point to a genuine-but-moderate issue rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3 Medium) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction, but the impact is confined to low-confidentiality information disclosure (C:L) with no integrity or availability effect - consistent with an out-of-bounds read (CWE-125) that leaks adjacent memory rather than enabling code execution. EPSS is low at 0.17% (6th percentile), the CVE is NOT on CISA KEV, and no public exploit or PoC reference is present in the supplied data, so there is no evidence of active or imminent widespread exploitation. The vuln.today decision label is 'this_month', which aligns with a routine-but-timely patch priority rather than act_now/emergency. The one tension worth flagging: the CVSS vector asserts AV:N and UI:N, yet the flaw lives in a media/audio codec path (Vorbis codebook decoding), where triggering normally depends on the device processing attacker-supplied audio content; the supplied evidence does not describe the exact delivery path, so treat the 'no interaction, network' framing as the vendor's rating rather than an independently confirmed drive-by. Net: a real vulnerability warranting inclusion in the normal monthly Android patch cycle, not a drop-everything priority.

An attacker crafts a malformed Vorbis audio stream whose codebook triggers the logic error in decode_packed_entry_number, then gets an Android device to decode it (for example via content delivered over the network). When the codec parses the crafted codebook, the out-of-bounds read exposes adjacent process memory, disclosing information to the attacker with no user interaction and no elevated privileges. No public exploit identified at time of analysis; AC:L indicates a crafted input reliably triggers the condition, though the exact trigger details are not described in the available sources.