EUVD-2026-37212
GHSA-c466-9244-9cr2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remotely delivered crafted RTCP packet requires the victim to engage a media session (UI:R) but no auth (PR:N); impact is a bounded read-only memory leak, so C:L only.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
5DescriptionCVE.org
In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
AnalysisAI
An out-of-bounds read in Android's RTCP BYE packet decoder (RtcpByePacket::decodeByePacket) allows a remote party in an RTP/RTCP media session to disclose a limited amount of device memory by sending a malformed BYE packet. The flaw is reached over the network (AV:N) with no privileges required on the target (PR:N), but the CVSS UI:R metric means the victim must engage with the call or media stream carrying the packet, and impact is confined to low confidentiality loss (C:L) with no integrity or availability effect and no code execution. EPSS is 0.17% (6th percentile) and CISA's SSVC assessment rates exploitation as none and automatable as no, with no public exploit identified at time of analysis; this is a genuine but low-priority issue requiring an unpatched Android build prior to the June 2026 patch level.
Technical ContextAI
RTCP (RTP Control Protocol) is the companion control channel to RTP, carrying sender/receiver reports and session teardown messages such as the BYE packet; it is processed continuously by Android's media stack during VoIP calls, video conferencing, and streaming sessions. The affected routine, RtcpByePacket::decodeByePacket, parses an incoming BYE packet's length/field data without adequately validating the declared size against the received buffer, which the project classifies under CWE-120 (buffer copy without checking size of input) and which manifests here as a read past the end of the buffer rather than a memory-corruption write. Because the parsing path is reachable from network-supplied media traffic on the RTCP port, a crafted packet triggers the out-of-bounds read and can leak limited adjacent memory back through observable protocol behavior, but the primitive is disclosure-only - there is no path to control-flow hijack, memory corruption write, or denial of service. The affected CPE is cpe:2.3:a:google:android, and the EUVD record (EUVD-2026-37212) lists the Android kernel/Android platform as the impacted component; the underlying issue was reported by Google Devices and fixed in the Android/Pixel security bulletin dated 2026-06-01.
RemediationAI
The primary fix is to update affected devices to the Android security patch level dated 2026-06-01 or later, as published in the Pixel/AOSP bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01; because the impacted parser is part of the platform media stack, OEM and carrier builds that backport the bulletin must be verified, not just Pixel releases. If immediate patching is not possible, reduce exposure by restricting which applications and network peers can deliver RTCP traffic to the device - for example, confine VoIP and conferencing apps to trusted networks/endpoints through firewall or MDM policy, and disable or block unused real-time media services - accepting the trade-off that this degrades legitimate calling and streaming functionality. Session-level controls also help: require authenticated/encrypted media (SRTP with peer verification) and avoid joining untrusted call or media sessions, since exploitation needs the user to engage with the session carrying the malicious BYE packet. There is no vendor-released standalone workaround beyond the bulletin patch, and no evidence that a public exploit exists, so remediation can be prioritized alongside routine monthly maintenance rather than as an emergency action.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today