CVE-2026-0127: Android Out-of-Bounds Read in Communication Processor – Impact & Patch Guidance

Technical summary

CVE-2026-0127 is an out-of-bounds read vulnerability in the NrmmMsgCodec::DecodeUPUTransparentContext function within Android's cn_NrmmDecoder.cpp. The flaw occurs during decoding of UPU (User-to-User) transparent context data in network messaging. Insufficient bounds validation allows an attacker to read beyond allocated memory regions, resulting in memory corruption that typically manifests as a communication processor crash (often the modem or RIL—Radio Interface Layer). The vulnerability is classified as CWE-125 (Out-of-Bounds Read), and exploitation requires network-layer access with valid authentication credentials but no privilege escalation is necessary.

Business impact

Organizations deploying Android devices in production environments—particularly those in telecommunications, enterprise mobility, or critical communications infrastructure—face potential service disruption. Affected devices experience unscheduled modem or communication subsystem restarts, causing temporary loss of cellular connectivity and potentially disrupting VoIP, SMS, and data services. While not providing data exfiltration or system compromise, repeated exploitation could degrade device reliability and support costs. Industries relying on continuous mobile connectivity (financial services, emergency dispatch, field operations) should assess their exposure.

Affected systems

Google Android devices are affected by this vulnerability. The exact version range, specific Android releases, and device models have not been disclosed in public advisories at the time of this analysis—verify the vendor advisory for comprehensive affected-version information and determine which device models and Android versions deployed in your environment are impacted.

Exploitability

Exploitation requires an attacker to be on the same network or have routing-level access to send crafted network messages to an affected device. The attacker must possess valid authentication credentials to the communication subsystem, though standard user-level network permissions are sufficient. No user interaction is required; the crash occurs automatically upon receipt of a malformed message. The attack is reliable but limited in scope to denial of service.

Remediation

Apply the security patch released by Google for your specific Android version and device model. Check the Android Security & Privacy Year in Review bulletin and your device manufacturer's security updates. Until patching is feasible, consider network segmentation to restrict untrusted traffic to the communication processor, though this may be impractical in standard mobile deployments. Organizations should prioritize patching devices in security-sensitive roles.

Patch guidance

Verify the applicable Android security patch level and OEM-specific updates from Google's official security bulletins and your device manufacturer's support pages. Patches are typically delivered through monthly Android security updates. Test patches in a controlled environment before enterprise deployment, particularly for devices in production telecommunications or critical infrastructure roles. Ensure device management solutions (MDM/EMM) are configured to enforce timely patch deployment.

Detection guidance

Monitor for unexpected modem or communication processor restarts on affected Android devices, which may indicate exploitation attempts. Network detection is difficult without deep packet inspection of radio interface protocols; focus instead on behavioral signals such as repeated loss of cellular connectivity followed by automatic recovery on specific device cohorts. Correlate modem crash logs with network traffic patterns. Device-level telemetry from Android Enterprise or Samsung Knox (if deployed) may provide additional visibility into radio subsystem anomalies.

Why prioritize this

While the CVSS score of 6.5 (MEDIUM) reflects the absence of data breach or privilege escalation risk, the practical impact of repeated communication subsystem crashes warrants prompt attention in any organization with mobile workforce dependencies. The low attack barrier (network access plus basic authentication) combined with no user interaction requirement elevates real-world risk. Prioritize based on business criticality of continuous cellular connectivity for affected user populations.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM severity) reflects: Network accessibility (AV:N) without authentication bypass, low attack complexity (AC:L), authentication requirement (PR:L—a standard network-level credential), no user interaction (UI:N), and high impact on availability (A:H) with no confidentiality or integrity impact (C:N, I:N). The score appropriately captures a denial-of-service scenario that does not compromise data but does impair service continuity. Organizations with high availability requirements may assess risk higher than the base score suggests.

Frequently asked questions