CVE-2026-0155: Android ImsMediaBitReader OOB Read Information Disclosure

Technical summary

The ImsMediaBitReader::ReadByteBuffer function in Android lacks proper bounds validation before performing buffer reads. When a specially crafted input is processed, the read operation can extend past the allocated buffer, resulting in an out-of-bounds (OOB) read. The vulnerability is rooted in missing length checks (CWE-120: Buffer Copy without Checking Size of Input, CWE-125: Out-of-bounds Read). Exploitation requires network access and valid credentials, but no special privileges or user interaction.

Business impact

An authenticated attacker can extract sensitive data resident in adjacent memory regions without triggering crashes or alerts. In multi-tenant or enterprise Android deployments, this could expose per-user or per-process information (encryption keys, tokens, PII) to an attacker who has compromised a single account. The impact is information disclosure only; systems remain operational and functional, lowering immediate incident severity but increasing long-term compliance and trust risks.

Affected systems

Google Android devices and systems running affected versions of the ImsMediaBitReader component. The vulnerability requires network access and valid user credentials, so it primarily affects Android installations where the attacker has obtained login credentials or where the Android device is enrolled in networks allowing authenticated access to IMS (IP Multimedia Subsystem) services.

Exploitability

Exploitation is straightforward for an attacker with valid credentials. The attack vector is network-based, access complexity is low, and no user interaction is required. However, the requirement for authentication (PR:L in CVSS terms) is a meaningful friction point. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild is not yet documented, though the ease of exploitation means defensive delay is inadvisable.

Remediation

Apply security updates from Google when released. Until patching is feasible, restrict network access to IMS services and enforce strong authentication and access controls to minimize the chance an attacker obtains valid credentials. Network segmentation can reduce lateral movement if credentials are compromised.

Patch guidance

Monitor Google Android Security Bulletins and your device manufacturer's security advisories for patched versions. Verify patch availability for your specific Android version and device model; rollout timelines vary by OEM. Once patches are released, prioritize deployment in environments where IMS services are actively used and where credential compromise is a realistic threat model.

Detection guidance

Look for unusual access patterns to IMS or media processing components, especially from authenticated users at unexpected times or from unusual locations. Monitor for repeated failed or suspicious calls to bit-reading functions in system logs. A behavioral baseline of normal IMS traffic will help identify anomalous access. Host-based monitoring for process memory access patterns may also surface exploitation attempts, though detection is challenging because no crash or error condition occurs.

Why prioritize this

Although the CVSS score of 4.3 (MEDIUM) reflects the information-disclosure-only impact and authentication requirement, the ease of exploitation and potential sensitivity of data in memory warrants earlier attention than the score alone suggests. Organizations with high-value user data, strong compliance requirements, or where credential compromise is plausible should elevate this above routine patch schedules. Conversely, air-gapped or restricted-access Android deployments face lower practical risk.

Risk score, explained

The score of 4.3 reflects: network exploitability (AV:N), low attack complexity (AC:L), the requirement for valid credentials (PR:L), no user interaction needed (UI:N), confidentiality impact limited to the attacked user's context (C:L), and no integrity or availability impact (I:N, A:N). The authentication barrier prevents opportunistic mass exploitation but does not eliminate risk in environments where credentials are routinely shared, stolen, or reused.

Frequently asked questions