CVE-2026-0149: Android RTP Heap Buffer Overflow Leading to Remote Code Execution

Technical summary

The vulnerability exists in RtpSession::rtpSendRtcpPacket, where insufficient bounds checking on heap-allocated buffers permits an out-of-bounds write during RTCP packet construction. The flaw is classified as both CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). An attacker positioned to send RTCP traffic to the vulnerable component can craft a malicious packet that triggers the overflow, corrupting heap metadata and adjacent objects. Given the low complexity of exploitation (network-accessible, no user interaction required) and the low privilege barrier (PR:L indicating low privileges needed), the attack surface is significant. Successful exploitation results in code execution within the context of the RTP session process.

Business impact

Organizations running Android devices that expose or rely on RTP-based communications—including VoIP applications, video conferencing clients, and real-time media streaming—face remote code execution risk. Compromised devices can be used as pivot points within internal networks, especially in enterprise environments where authenticated VoIP or video conferencing infrastructure exists. The impact extends beyond confidentiality and integrity to full availability disruption; attackers could halt communications or hijack media streams. For consumer users, this threatens privacy of calls and messages. The low privilege requirement means even users with restricted device access can become attack vectors.

Affected systems

This vulnerability affects Google Android. The scope is limited to systems running vulnerable versions of Android that include the affected RtpSession implementation. Devices actively using RTP-based applications (VoIP, video conferencing, media streaming) are at higher risk. Any Android version with the unpatched RtpSession code is vulnerable; verify against Google's Android Security & Privacy Year in Review and vendor advisories for specific affected API levels and device models.

Exploitability

The vulnerability is highly exploitable due to low attack complexity (AC:L) and minimal privilege requirements (PR:L). An attacker already present on the network or authenticated to the system needs only to send a malformed RTCP packet; no user action is required (UI:N). The attack requires neither special tools nor detailed reverse engineering—standard network packet manipulation suffices. The primary constraint is network proximity or authentication, which is not a significant barrier in internal networks or shared VPN environments. No public exploit code has been added to CISA KEV as of the published date, but the straightforward nature of the vulnerability makes public tools likely to emerge rapidly.

Remediation

Apply the security patch released by Google for this vulnerability as soon as it becomes available. Monitor Google's official Android security advisories and your device manufacturer's updates for patch details and timeline. For devices unable to receive OTA updates, consider network isolation of RTP-based services or disabling RTP functionality if the business use case permits. Organizations should prioritize patching devices actively used for voice or video communications, especially those in sensitive network segments.

Patch guidance

Wait for official guidance from Google Android Security. When patches are released, they will typically appear in monthly Android Security & Maintenance Release bulletins. Device manufacturers (Samsung, Pixel, etc.) will release updates on their own timelines following Google's patch publication. For enterprise environments, coordinate with Mobile Device Management (MDM) solutions to ensure fleet-wide deployment. Test patches in a staging environment first, particularly for devices serving critical communications infrastructure. Check vendor advisories for specific version numbers and rollout timelines; this summary will be updated once official patches are published.

Detection guidance

Monitor network traffic for unusual RTCP packets destined to RTP-enabled services, particularly those with malformed packet structures or abnormal sizes. Implement packet inspection rules flagging RTCP packets with invalid header lengths or options. On vulnerable devices, watch for unexpected process crashes in media or VoIP applications, sudden memory corruption errors, or unexpected process privilege escalation. Check system logs for segmentation faults or abort signals in RTP-related services. EDR and network detection should flag multiple failed or suspicious RTCP attempts from the same source, or successful exploitation attempts indicated by child process spawning from RTP service contexts.

Why prioritize this

This vulnerability merits immediate attention despite absence from CISA KEV due to its high severity (CVSS 8.8), remote exploitation path, and low barrier to attack. The combination of network accessibility, minimal privilege requirements, no user interaction, and direct RCE capability makes it attractive to attackers. Android's ubiquity means impact scale is potentially massive. Organizations relying on Android devices for communications should treat this as a critical priority until patches are deployed and verified.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the most severe aspects: network-accessible attack vector (AV:N), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and complete compromise of confidentiality, integrity, and availability (C:H, I:H, A:H). The score does not incorporate threat intelligence, KEV status, or organizational context; however, the absence of public exploitation reports as of publication and the narrow attack surface (RTP sessions specifically) provide modest mitigation compared to the intrinsic severity. Environment-specific risk will depend on the prevalence of RTP applications and network exposure in your organization.

Frequently asked questions