What is the CVSS score of EUVD-2026-37189?

EUVD-2026-37189 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Android EUVD-2026-37189

| CVE-2026-0155 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-06-16 Google_Devices

GHSA-p4qf-rxqh-8x9m

Buffer Overflow Information Disclosure Google

5.3

CVSS 3.1 · Vendor: Google_Devices

Severity by source

Vendor (Google_Devices) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network vector confirmed by IMS media delivery; PR:L reflects requirement for an established IMS session; C:L only, no write primitive exposed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Google_Devices).

CVSS VectorVendor: Google_Devices

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Sep 16, 2026 - 17:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Jul 22, 2026 - 23:07 vuln.today

CVE Published

Jun 16, 2026 - 18:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 16, 2026 - 18:51 cve.org

MEDIUM 4.3

DescriptionCVE.org

In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Out-of-bounds read in Android's ImsMediaBitReader::ReadByteBuffer exposes memory contents to remote attackers over network-reachable IMS (IP Multimedia Subsystem) sessions, including VoLTE calls. Affected Android versions allow a low-privileged remote party to trigger the missing bounds check and extract a limited portion of process memory, resulting in information disclosure with no user interaction required. No public exploit has been identified at time of analysis, and SSVC classifies exploitation as none with partial technical impact, making this a low-urgency but real network-reachable exposure.

Technical ContextAI

ImsMediaBitReader is a component of the Android IMS media framework (cpe:2.3:a:google:android:*:*:*:*:*:*:*:*), responsible for parsing bit-level streams in IMS multimedia sessions such as VoLTE audio and video calls. The root cause is CWE-120 (Buffer Copy Without Checking Size of Input), specifically a missing bounds check in the ReadByteBuffer method that allows reads beyond the allocated buffer boundary. Attackers can supply crafted RTP/IMS media packets to a target device in an active session, causing the reader to access memory outside the intended buffer. The vulnerability is confined to confidentiality impact only - no write primitive is exposed, meaning memory corruption leading to code execution is not indicated by this bug class.

RemediationAI

Apply the patch delivered through the Google Pixel Security Bulletin for June 2026, available at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01. The exact patched Android build version is not independently confirmed from available data beyond this bulletin reference. For non-Pixel OEM devices, monitor vendor-specific security bulletins for downstream patch availability, as IMS stack adoption varies by OEM. As a compensating control, disabling VoLTE on devices where it is not operationally required removes the primary attack surface, though this degrades call quality and may impact emergency services calling in some regions. Organizations managing Android fleets should prioritize patch deployment on devices where VoLTE is enabled and internet-reachable IMS endpoints are exposed.