CVE-2026-0140: Android RTP Integer Overflow Information Disclosure Vulnerability

Technical summary

The vulnerability stems from an integer overflow in Android's RtpPacket::decodePacket implementation (CWE-190). This overflow condition enables an out-of-bounds read (CWE-125) when decoding RTP packet headers or payloads. The integer overflow likely occurs during size or offset calculations, allowing an attacker to specify memory access beyond the allocated buffer. Since RTP is a network protocol commonly used in VoIP and video streaming, the attack surface includes any application or system service that processes RTP traffic. The information disclosed depends on what data resides adjacent to the vulnerable buffer in memory.

Business impact

Information disclosure from this vulnerability could expose call audio, video streams, or metadata from communications applications. For enterprises, the risk extends to any system ingesting RTP streams: unified communications platforms, IP-PBX systems, and video conferencing infrastructure. The medium CVSS score reflects the requirement for user interaction (e.g., accepting a call or joining a stream), but the attack requires no privilege escalation. Widespread Android deployment means the exposed device population is significant, though exploitation requires the user to engage with the malicious traffic.

Affected systems

Google Android devices are affected. Any Android application or system service that uses Android's standard RTP packet decoding library is potentially vulnerable. This includes built-in telephony and video streaming components, as well as third-party VoIP and conferencing applications. The scope depends on Android version and whether vendors have back-ported patches to older releases.

Exploitability

Exploitability is moderate. An attacker must craft a malicious RTP packet and deliver it to a target user—either via a VoIP call, video stream, or other RTP-based communication. The user must interact with the stream (accept the call, join the conference) for the vulnerable code path to execute. No authentication or elevated privileges are required. The attack is network-accessible and does not require physical access. However, the need for user interaction limits the attack surface compared to a fully remote, unauthenticated code execution vulnerability.

Remediation

Remediation requires applying a patch from Google that fixes the integer overflow in RtpPacket::decodePacket. Users should install available Android security updates through their device settings. Manufacturers and carriers should prioritize deployment of the security patch to their supported Android versions. Until patched, users can reduce exposure by disabling RTP-based applications or avoiding calls from untrusted sources—though this is impractical for most users.

Patch guidance

Monitor Google's Android Security & Privacy Year in Review or monthly security bulletins for patch availability and affected Android versions. Patches are typically delivered via system updates. OEMs and carriers may release updates on different timelines; check your device manufacturer's support page for the specific patch version applicable to your device model and Android version. Enterprise deployments should coordinate patch rollout through their mobile device management (MDM) platform and verify compatibility before widespread deployment.

Detection guidance

Detection at the network level is challenging because malicious RTP packets may be difficult to distinguish from legitimate traffic without deep packet inspection. Host-based detection could monitor for unexpected out-of-bounds memory access errors, crashes in RTP-related processes, or crashes in communication applications following RTP packet receipt. Security monitoring should flag any crashes or memory access violations in libStagefright or RTP-related libraries. Endpoint Detection and Response (EDR) tools capable of monitoring system-level memory access violations may detect exploitation attempts.

Why prioritize this

Prioritize this patch for Android devices in your environment, particularly those used by executives or sensitive roles. While the CVSS score is medium, the attack surface (any user receiving a call or video stream) and the information disclosure risk (exfiltration of communications content) warrant timely remediation. The requirement for user interaction prevents this from being critical, but the ease of triggering exploitation and the ubiquity of RTP in communications applications justify expedited patching.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: no authentication required, network-accessible attack vector, low attack complexity, but mandatory user interaction. The scope is unchanged (only the vulnerable component affected), and the impact is confidentiality loss only—no integrity or availability impact. The medium score is appropriate given that information disclosure is serious but requires the user to engage with malicious content. Threat context (e.g., is your organization targeted by focused attacks on communications?) should inform local risk scoring above or below this baseline.

Frequently asked questions