CVE-2026-0146: Android Media Codec Out-of-Bounds Write – RCE Risk

Technical summary

The vulnerability exists in mfc_core_get_dec_metadata_sei_nal within mfc_core_reg_api.c, a Media Format Codec (MFC) parser component responsible for extracting SEI (Supplemental Enhancement Information) NAL units from video bitstreams. The function fails to validate output buffer capacity before writing parsed metadata, creating a classic out-of-bounds write (CWE-787) compounded by insufficient input validation (CWE-120). An authenticated local process can construct a malformed video file or stream with oversized SEI metadata that, when decoded, writes past the bounds of heap or stack buffers. Depending on memory layout and kernel ASLR effectiveness, this can corrupt adjacent objects, heap metadata, or return addresses, enabling RCE without privilege escalation.

Business impact

Exploitation allows an authenticated user to escalate privileges and execute arbitrary code in the kernel context, effectively gaining full device compromise. For enterprise deployments relying on Android for secure communications, sensitive data processing, or trusted device management, this represents a critical integrity and confidentiality breach. An attacker gaining kernel access can install persistent malware, exfiltrate cryptographic keys, intercept encrypted communications, or pivot to enterprise networks. The attack surface includes any application receiving video input—video players, messaging apps, video conferencing platforms, and media processing services all become potential attack vectors if they process untrusted video streams.

Affected systems

Google Android systems are directly affected. The vulnerability is introduced in the media codec framework's memory-format controller module. The scope encompasses all Android versions shipping the vulnerable mfc_core_reg_api.c code; patch guidance from Google should specify minimum affected API levels and patch release versions. Devices actively receiving video input from untrusted sources—particularly those on enterprise networks or handling sensitive data—face the highest operational risk. OEM derivative implementations based on affected Android releases are likely vulnerable unless independently patched.

Exploitability

Exploitability is high but requires authentication: the attacker must already possess local system access or run an unprivileged application context. No network exploitation is possible without first compromising a local process. The attack requires no user interaction and is deterministic—a correctly crafted video file will trigger the overflow reliably. The low complexity (AC:L) and absence of special configuration requirements mean that once local access is obtained, successful exploitation is nearly guaranteed. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects this: network-reachable impact, but contingent on existing privilege. In practice, this is often paired with other vulnerabilities enabling initial local code execution, forming a common exploit chain.

Remediation

The fix requires adding bounds validation before the write operation in mfc_core_get_dec_metadata_sei_nal. Developers should calculate expected metadata output size, validate against the allocated buffer capacity, and reject or truncate oversized payloads. Alongside the immediate patch, applications should minimize the privilege context in which video decoding occurs, disable video processing in low-trust code paths, and apply Android security framework mitigations (SELinux policies, seccomp filters) to constrain codec process permissions. Systems must also enforce strict input validation on video sources and avoid processing video from unverified suppliers.

Patch guidance

Monitor Google's Android Security & Privacy Year in Review and Monthly Security Bulletins for patched versions and CVE details. Patches will be released as monthly security updates targeting affected API levels. To ensure timely remediation: (1) identify Android versions and API levels in your deployed fleet, (2) cross-reference against vendor patch releases, (3) test updates in a staging environment to verify codec stability and application compatibility, (4) prioritize deployment for high-risk devices or those handling sensitive video input, (5) verify patch application by checking kernel and codec component build dates. OEMs and carriers should coordinate patch release schedules to minimize window of vulnerability.

Detection guidance

Monitor for video-processing crashes or kernel panics triggered by unusual media files. Detection at runtime is challenging without kernel instrumentation; focus instead on prevention and monitoring for exploitation attempts. Enable audit logging for codec component access and monitor for abnormal SEI NAL unit sizes within video streams. Host-based intrusion detection can flag unexpected kernel memory corruption patterns or privilege escalation following video processing. Network-based detection is limited since the attack is local; however, monitoring for suspicious video file distribution to target devices via email, messaging, or content delivery may reveal reconnaissance or pre-exploitation activity. Engage threat intelligence feeds for proof-of-concept or active exploitation indicators following public disclosure.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of high CVSS score (8.8), unauthenticated impact on confidentiality, integrity, and availability, and the ubiquity of Android video processing in enterprise and consumer devices. Although exploitation requires local access, the absence of user interaction and deterministic nature of the overflow make it an attractive post-compromise payload for attackers establishing persistence or pivoting to other systems. Devices in regulated industries (finance, healthcare, government) or handling PII should be patched within days, not weeks. The lack of active KEV status does not diminish urgency; exploit development and weaponization are likely underway given the straightforward bounds-check fix and media codec focus.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a direct path to kernel code execution with full system compromise. The score accounts for local-only initial access (lowering impact) but recognizes that once local execution is achieved, there are no mitigating factors—no additional privileges required, no user interaction, and no scope limitation. The severity is dampened only by the authentication requirement; without it, the score would approach critical. For risk prioritization within an organization, elevate this beyond the CVSS rating if your environment contains devices frequently receiving video from untrusted sources or if post-compromise persistence and lateral movement are concerns.

Frequently asked questions