CVE-2026-0128: Android RTCP Out-of-Bounds Read Information Disclosure

Technical summary

CVE-2026-0128 is an out-of-bounds read vulnerability in the RtcpFbPacket::decodeRtcpFbPacket function stemming from an integer overflow (CWE-190). When the function processes a specially crafted RTCP (Real-Time Control Protocol) feedback packet, the integer overflow permits reading memory beyond the allocated buffer. The vulnerability is classified as a CWE-125 (Out-of-bounds Read) condition. Because RTCP is part of the RTP protocol stack commonly used in real-time media applications, the attack surface includes any application on Android that processes video or audio streams without proper input validation.

Business impact

Organizations relying on Android devices for secure communications face a confidentiality risk. If an attacker can inject or intercept RTCP feedback packets, they may exfiltrate sensitive information such as cached credentials, encryption keys, or application data residing in adjacent memory. The impact is amplified in enterprises using video conferencing, VoIP, or secure media applications on Android. However, the attack requires user interaction, which limits opportunistic exploitation. For sectors handling regulated data (healthcare, finance, legal), even a confidentiality breach can trigger compliance violations and incident response costs.

Affected systems

Google Android is the affected platform. The vulnerability resides in the RTCP packet processing layer, which means all Android versions and devices using the vulnerable code path are at risk. The exact scope of affected Android versions is not specified in the available advisory data; verify the vendor's security bulletin for specific version ranges and patch timelines. Third-party applications that implement or rely on the standard Android media stack for real-time communications are similarly exposed.

Exploitability

The vulnerability has a network attack vector with low complexity, requiring no special privileges. However, user interaction is mandatory—the user must engage with content that triggers RTCP packet processing, such as joining a video call or viewing a live stream from an attacker-controlled source. This prerequisite significantly reduces the practical exploitation window compared to remote code execution flaws. The attack does not require convincing a user to install malicious software or grant unusual permissions, only to participate in normal media consumption. An attacker with network access (for example, on the same WiFi or a compromised media relay server) is best positioned to deliver the malicious packet.

Remediation

Apply the security patch released by Google for Android. The patch addresses the integer overflow by adding proper bounds checking before performing out-of-bounds read operations in the RTCP decoder. Until patching is complete, mitigations include disabling real-time media features in high-risk applications, restricting access to trusted media sources only, and using network segmentation to limit an attacker's ability to inject packets. End users should prioritize installing Android security updates as they become available.

Patch guidance

Check the Google Android Security & Privacy Year in Review and monthly security bulletins for the specific patch version and affected Android versions. Patches are typically released on a monthly cadence. Device manufacturers and carriers may introduce additional delays. For enterprise deployments, coordinate patching through your MDM solution to ensure timely rollout. Test patches in a controlled environment before broad deployment, particularly for devices running business-critical applications. Verify patch application by confirming the security patch level in device settings.

Detection guidance

Monitor for unusual RTCP packet patterns or malformed packets arriving on your network. Anomalies may include packets with invalid length fields, integer overflow signatures, or payloads inconsistent with legitimate media streams. On-device detection is challenging because the vulnerability triggers silently during normal packet processing. Network-level detection using IDS/IPS signatures targeting malformed RTCP payloads may help catch delivery attempts. Endpoint detection and response (EDR) solutions can flag unusual memory access patterns or information exfiltration from media applications. Review application logs for unexpected errors or crashes in media handling code.

Why prioritize this

Although classified as MEDIUM severity (CVSS 6.5), the vulnerability warrants timely attention because it affects the widely deployed Android platform and requires minimal attacker capability. The user interaction requirement prevents it from being CRITICAL, but the confidentiality impact and network accessibility make it suitable for a 30–60 day remediation window. Prioritize patching devices used for sensitive communications, video conferencing, or secure media access. Devices in kiosk or restricted-use deployments with no media streaming may be lower priority.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible vulnerability with high confidentiality impact but no integrity or availability impact. The requirement for user interaction reduces the score from HIGH to MEDIUM. The attack requires no privileges and has low complexity, making it relatively straightforward for an attacker to craft a malicious packet. The score does not account for the widespread adoption of Android or the ubiquity of media applications; in risk modeling, consider raising the priority based on organizational exposure to real-time communications.

Frequently asked questions