CVE-2026-0147: Android MFC Out-of-Bounds Write Remote Code Execution

Technical summary

The vulnerability exists in the __mfc_core_nal_q_get_dec_metadata_sei_nal function within mfc_core_nal_q.c, where insufficient bounds validation during SEI (Supplemental Enhancement Information) NAL unit metadata parsing permits an out-of-bounds write. The flaw falls under both CWE-120 (Buffer Copy without Checking Size of Input) and CWE-787 (Out-of-bounds Write), enabling memory corruption that can be leveraged for code execution. An authenticated user with network access can trigger this condition without requiring interactive user involvement on the target device.

Business impact

For organizations deploying Android devices—particularly in enterprise environments where these devices process sensitive data or maintain network access—this vulnerability presents significant risk. A compromised device could be weaponized to exfiltrate data, move laterally within networks, or become part of an attack infrastructure. Device management and mobile security teams should prioritize assessment of exposure and patch deployment timelines, as the barrier to exploitation is low once an attacker gains initial network-level authentication.

Affected systems

Google Android is the affected platform. The vulnerability is present in the media framework component responsible for video decoding and metadata extraction. Devices running affected Android versions are at risk if they process video content containing malicious SEI metadata. Verify the specific Android version ranges impacted against Google's official security bulletin for precise scope.

Exploitability

This vulnerability has a CVSS 3.1 score of 8.8 (HIGH) with a network-based attack vector, low complexity, and requirement for low privileges. Critically, no user interaction is required—an attacker with authenticated access can trigger exploitation through crafted video payloads. The absence of CISA KEV designation does not diminish the risk; it reflects current observed exploitation rather than inherent exploitability. The low barrier to weaponization makes this a priority for patching ahead of active exploitation disclosure.

Remediation

Apply the security patch released by Google on or after June 2026 for your Android version. Bounds checking logic must be added to __mfc_core_nal_q_get_dec_metadata_sei_nal to validate metadata size against allocated buffer limits before writing. Verify patch deployment across your device fleet, prioritizing devices with network exposure and those handling untrusted video content.

Patch guidance

Google will provide patched Android versions through the standard security update cycle. Check Google's Android Security & Privacy Year in Review bulletin and vendor-specific update channels (carrier, OEM, or AOSP) for your device model. Patch testing should confirm no regression in video decoding functionality, particularly for edge cases involving non-standard or legacy SEI metadata. Rollout should target high-risk cohorts first: internet-facing devices, those in security-sensitive environments, and devices running older Android versions.

Detection guidance

Monitor for instances of media decoder crashes or unexpected terminations, particularly following attempts to process video files with unusual or minimal metadata. Network-based detection is limited due to the authentication requirement; focus on endpoint telemetry and device logs. Look for signs of memory corruption or privilege escalation attempts originating from media framework processes. Intrusion detection systems should flag unusual SEI metadata patterns if decoding traffic can be inspected; however, encrypted video streams limit this approach. Device management solutions should track patch compliance and quarantine non-compliant devices from sensitive networks.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of high CVSS score (8.8), low exploitation complexity, absence of user interaction requirements, and broad Android deployment. While not yet on the KEV catalog, the attack surface is significant and the consequences—remote code execution with user-level privileges—are severe. Organizations should treat this as a critical-priority patch cycle item, especially for devices in regulated industries or handling sensitive data.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the severity drivers: network-accessible attack surface (AV:N), low attack complexity (AC:L), requirement for low-level privileges (PR:L), lack of user interaction (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score is appropriately high because an authenticated attacker can directly achieve code execution without additional hops or user involvement. The primary mitigating factor—authentication requirement—is insufficient to reduce the score materially, as many enterprise networks allow broad intra-network access.

Frequently asked questions