CVE-2026-0129: Android RTCP Bye Packet Information Disclosure Vulnerability

Technical summary

CVE-2026-0129 exists in the RtcpByePacket::decodeByePacket function within Google Android. A missing bounds check (CWE-120: Buffer Copy without Checking Size of Input) allows an attacker with valid network credentials to craft a malicious RTCP Bye packet that reads beyond allocated buffer boundaries. The attack vector is network-based, requires low complexity, mandates authenticated access, and needs user interaction to succeed. The vulnerability is confined to the calling process with no impact on system integrity or availability.

Business impact

Information disclosure via RTCP Bye packets could expose fragments of real-time communication session data, potentially including metadata about active calls, participant information, or protocol state. For organizations deploying Android devices in VoIP or video conferencing environments, this creates a privacy risk rather than an operational emergency. The low CVSS score and user-interaction requirement limit immediate business urgency, but sensitive communications deserve attention in compliance-heavy sectors.

Affected systems

Google Android is the sole affected vendor/product. The vulnerability applies to Android devices that process RTCP Bye packets; this includes any device running vulnerable Android versions involved in RTP-based real-time communications (VoIP, video calls, conferencing apps). Check your vendor's security bulletin for specific Android version ranges and whether patched builds are available.

Exploitability

Exploitation is difficult in practice. An attacker must be on the network path (or spoofed into it), possess authenticated credentials, and convince a user to initiate or receive a real-time communication session. The attacker then injects a malformed RTCP Bye packet. This is not a worm vector, zero-day exploitation is unlikely, and casual attackers lack practical tools. Insider threats with network access pose the primary risk.

Remediation

Apply the latest Android security patch from Google for your device model. Check the Android Security & Privacy Year in Review or your device manufacturer's support page for the patch level that addresses CVE-2026-0129. For enterprise deployments, validate patch deployment across managed Android devices and ensure real-time communication apps are updated to versions compiled against the patched Android framework.

Patch guidance

Verify the Android security patch level (Settings > About Phone > Android Security Patch Level) against Google's CVE advisory to confirm the fix date. Patch availability varies by OEM and carrier; some devices may require manual enrollment in beta channels or may not receive a patch. Prioritize patching devices that handle sensitive communications, then extend to standard fleet. Test patch rollout on non-critical devices first to avoid communication service disruption.

Detection guidance

Detection at runtime is difficult without instrumentation; malformed RTCP packets are typically logged at the codec or media framework level, not the OS security event stream. Network-based detection via IDS/IPS examining RTCP packet structure for malformed Bye messages is theoretically possible but rarely tuned by default. Focus on patch compliance scanning and device inventory to identify Android versions at risk. Application-level logging in VoIP/conferencing apps may capture session anomalies if misconfigured packets trigger errors.

Why prioritize this

Despite low CVSS (3.5), this vulnerability warrants medium priority in risk-ranked patch cycles because it requires authentication and user interaction, limiting mass exploitation, but affects a widely-deployed OS. Organizations with large Android fleets, especially in regulated sectors handling confidential communications, should prioritize patch application within 60–90 days. Low-risk deployments (consumer devices, non-sensitive use) may defer to routine patch cycles.

Risk score, explained

CVSS 3.5 (Low) reflects the combination of network access, low attack complexity, required authentication, user interaction, and impact limited to confidentiality. The score appropriately downgrades severity because the attack is not remotely exploitable without user action and does not affect integrity or availability. However, context matters: organizations handling highly sensitive real-time communications may subjectively raise priority despite the low base score.

Frequently asked questions