CVE-2026-0141: Android RTCP Out-of-Bounds Read Information Disclosure

Technical summary

CVE-2026-0141 is an out-of-bounds (OOB) read vulnerability in the decodeAppPacket function within RtcpAppPacket.cpp on Android. The vulnerability stems from insufficient validation of packet length before reading from a buffer, violating CWE-120 (buffer copy without checking size of input) and CWE-125 (out-of-bounds read). An attacker sending a specially crafted RTCP APP packet across the network can trigger the OOB read. The vulnerability requires authenticated network access (PR:L in the CVSS vector) but no user interaction, making it exploitable in automated attack scenarios.

Business impact

This vulnerability enables attackers with valid network credentials to exfiltrate sensitive information from Android devices without being detected by the user. In enterprise environments, this could lead to exposure of cached authentication tokens, call metadata, or other session-related data stored in memory. The low CVSS score reflects the requirement for prior authentication, but the zero-interaction nature and confidentiality impact warrant timely remediation to prevent reconnaissance activity and lateral movement in corporate networks.

Affected systems

Google Android is affected. The vulnerability exists in core RTCP packet handling, which is used in real-time communication frameworks. Devices running affected Android versions with the vulnerable RtcpAppPacket.cpp code are susceptible. Specific version ranges should be verified against Google's official security bulletin; patched Android versions will be documented there.

Exploitability

Exploitation requires network connectivity and valid credentials (authenticated attack vector). No zero-click exploitation is possible; the attacker must have login credentials or be positioned on a network with authenticated access. Once in that position, however, the attack is straightforward and does not require user interaction or system-specific configuration, making it a practical threat within the threat model of credential-compromised or insider scenarios. Active exploitation in the wild has not been confirmed as a CISA KEV entry.

Remediation

Apply security updates from Google as soon as they become available for your Android version. Verify the patch status via Google's Android Security & Privacy Year in Review and monthly security bulletins. Organizations should prioritize patching devices used by privileged users or those on untrusted networks. Network-level mitigations are limited; the primary control is keeping the OS current.

Patch guidance

Monitor Google's official Android security advisories for the CVE-2026-0141 patch date and version number. Once released, deploy the patch through your standard mobile device management (MDM) or over-the-air (OTA) update process. Test in a small pilot group first to ensure compatibility with your applications. Prioritize devices assigned to users with access to sensitive systems or data.

Detection guidance

Detection on the endpoint is challenging because this is an in-memory read with no filesystem or persistent side effects. Network detection is more feasible: monitor for anomalous RTCP APP packets sent to Android devices, particularly those with unusual length fields or from unexpected sources. Consider deploying network segmentation to restrict RTCP traffic to trusted real-time communication infrastructure. Log authentication failures and successful authentications to correlate with any suspected data exposure.

Why prioritize this

Although the CVSS score of 4.3 is medium, prioritization should account for the zero-interaction requirement and the prevalence of Android devices in your environment. If your organization includes Android enterprise deployments, healthcare, or finance verticals where information disclosure is sensitive, this warrants higher priority. The lack of KEV listing suggests no active widespread exploitation at publication, but that may change as awareness increases.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Medium severity driven by the low impact (confidentiality only, no integrity or availability loss), low attack complexity, and the requirement for prior authentication. The network attack vector prevents it from being scored higher. However, the combination of zero user interaction and the potential for reconnaissance in multi-stage attacks makes it worth treating as higher priority in risk rankings that account for attack chain potential.

Frequently asked questions