CVE-2026-0144: Android Audio Codec Denial of Service Vulnerability – Analysis & Patch Guidance

Technical summary

CVE-2026-0144 is a bounds-check bypass vulnerability in the writeAocCommand function of AocAudioCodec.cpp. The missing bounds validation permits an out-of-bounds memory write when handling malformed audio codec commands. This CWE-120 (Buffer Copy without Checking Size of Input) issue can be triggered by an authenticated network user sending a specially crafted command, resulting in denial of service through process termination or system instability. The vulnerability requires only network-level access and valid authentication credentials; no local access, elevated privileges, or user interaction is necessary.

Business impact

This vulnerability enables remote service disruption attacks against Android devices. An attacker with valid credentials on a network can render audio services unavailable, affecting communication features, multimedia playback, and any application depending on audio codec functionality. For enterprise deployments—particularly those using Android in voice, video conferencing, or real-time communication scenarios—this poses a business continuity risk. The attack requires authentication but no special privileges, making it a moderate operational hazard rather than a critical infrastructure threat.

Affected systems

Google Android is the affected product. The vulnerability exists in the audio codec subsystem (AocAudioCodec.cpp), so exposure is limited to Android devices with active audio processing capabilities. Devices that support audio playback or recording are vulnerable; headless or audio-disabled deployments may have reduced exposure. Specific version boundaries should be verified against Android security bulletins, as the ground-truth data does not enumerate exact affected releases.

Exploitability

Exploitation is relatively straightforward: an attacker must have network access and valid authentication credentials on the target system or network segment. No user interaction, zero-day sophistication, or privilege escalation is required—the attack is self-contained and deterministic. The CVSS vector (AV:N/AC:L/PR:L) reflects these low barriers. However, the attacker must be authenticated, which moderates the overall risk in properly segmented networks. The lack of KEV designation suggests active exploitation in the wild has not been documented as of the publication date.

Remediation

Apply the security patch from Google's Android Security & Privacy Year 2026 release bulletin. Coordinate with your device manufacturer for OTA (over-the-air) update availability, as Android patching timelines vary by vendor and carrier. For enterprise environments, verify patch coverage across managed devices and prioritize audio-critical systems. Interim mitigations include network segmentation to restrict authenticated access and disabling audio services if operationally feasible, though these are temporary measures pending patch deployment.

Patch guidance

Check Google's official Android Security Bulletin for June 2026 to identify the affected Android versions and corresponding patch levels. Patch guidance will typically reference specific monthly security patches or Android major version updates. Apply patches during a scheduled maintenance window to avoid disrupting audio-dependent services. If you operate Android devices as part of enterprise infrastructure, coordinate with your device administrator or carrier to confirm patch availability and deployment timeline. Always validate patch application in a test environment before broad rollout.

Detection guidance

Monitor for unexpected audio service crashes, restarts, or unavailability in logs (logcat, syslog). Look for network traffic patterns indicating repeated command submissions to audio codec services, especially from authenticated accounts with unusual behavior. Audio framework ANRs (Application Not Responding) or kernel panic logs related to AocAudioCodec may signal exploitation attempts. Implement network-based detection for malformed audio codec protocol messages sent to audio processing ports. Organizations with SIEM solutions should create alerts for audio subsystem failures correlated with network authentication events.

Why prioritize this

Although rated MEDIUM severity with a CVSS score of 6.5, this vulnerability merits timely attention because it requires only authentication (not privilege escalation) and causes guaranteed denial of service with no user interaction. Organizations operating audio-critical Android systems—call centers, emergency responders, teleconferencing infrastructure—should prioritize patching. The lack of KEV status indicates limited active weaponization, providing a window for orderly patching before adoption in broader attack campaigns.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity and low privilege requirements (authentication only). The vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H captures that confidentiality and integrity are unaffected, but availability is severely impacted. The score would be higher if no authentication were required, but the authentication barrier and absence of privilege escalation keep it in the medium range. Organizational risk may be higher if audio services are mission-critical.

Frequently asked questions