SEC.co
Emergency
HIGH 7.5

CVE-2026-0156: Android RTP Memory Safety Vulnerability—Denial of Service Risk

CVE-2026-0156 is a memory safety flaw in Android's RTP (Real-time Transport Protocol) session handling that allows an attacker to crash or disrupt media streaming without authentication. The vulnerability exists in the collision-detection code that processes incoming RTP packets; a missing validation check can cause the system to attempt operations on a null pointer, triggering a denial-of-service condition. An attacker on the network can exploit this remotely by sending specially crafted RTP traffic.

Source data · NVD / CISA · public domain

CVSS
3.1 · 7.5 HIGH · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses (CWE)
CWE-476
Affected products
1 configuration(s)
Published / Modified
2026-06-16 / 2026-07-06

NVD description (verbatim)

In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

1 reference(s) · View on NVD →

SEC.co analysis · AI-assisted, reviewed against source

Technical summary

The vulnerability is located in RtpSession.cpp's checkSsrcCollisionOnRcv function, which handles Synchronization Source (SSRC) collision detection in RTP streams. A missing null pointer check (CWE-476) means the function can dereference an uninitialized or null pointer when processing incoming RTP packets. This leads to a crash or service interruption in the audio/video streaming subsystem. The attack surface is any device or service that receives RTP packets over a network; no special privileges or user interaction required.

Business impact

Disruption of VoIP, video conferencing, or multimedia streaming services on Android devices. An attacker can remotely cause repeated denial-of-service conditions, degrading user experience for real-time communications. In enterprise environments, this could impact Teams, Zoom, Google Meet, or similar RTC-dependent workflows. Affected organizations should prioritize patching if their users rely on multimedia communication platforms.

Affected systems

Google Android devices and services that use the vulnerable RtpSession.cpp code path. This includes any Android application or system service that processes inbound RTP media streams. Verify your device's Android version and patch level against Google's security bulletins for the specific impacted versions.

Exploitability

Exploitability is straightforward: no credentials, user interaction, or elevated privileges are required. An attacker must be in a position to send network packets to the target device or service (same network segment or internet-routable path). The attack is reliable and can be triggered repeatedly. However, as of the data provided, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not yet been widely documented.

Remediation

Apply the latest Android security patch from Google that addresses CVE-2026-0156. Check your device manufacturer's security update page or Settings > System > System Update for available patches. Verify the patch date is on or after the vulnerability's publication (June 16, 2026) or the latest available security patch for your device model. Users unable to patch immediately should restrict exposure to untrusted networks when using real-time communication apps.

Patch guidance

Enable automatic system updates on Android devices. For enterprise deployments, coordinate with your mobile device management (MDM) solution to push the latest security patch to all managed devices. Consult Google's official Android security and privacy year-in-review or monthly security bulletins to confirm the specific patch version that resolves this issue. Verify that patched versions include fixes for the null pointer check in RtpSession.cpp.

Detection guidance

Monitor for repeated crashes or unexpected restarts of media-dependent applications (especially communication apps) without obvious user action. Log unexpected RTP session terminations or errors in multimedia subsystems. If you have network-level visibility, watch for anomalous RTP traffic patterns or repeated connection failures during media sessions. Endpoint detection and response (EDR) tools may flag unusual process crashes in the RTP stack.

Why prioritize this

A CVSS 7.5 (HIGH) network-based denial-of-service vulnerability affecting a widely-deployed platform warrants prioritization, especially if your workforce depends on mobile VoIP or video conferencing. The lack of KEV listing does not reduce urgency; it means exploitation may not yet be mainstream but the technical bar to exploit is very low. Organizations should patch as part of their regular monthly update cycle, prioritizing devices used for critical communications.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH-severity vulnerability: network accessibility (AV:N), low attack complexity (AC:L), no privileges or user interaction required (PR:N/UI:N), and high availability impact (A:H). The absence of confidentiality or integrity impact (C:N/I:N) prevents a critical rating. However, in a communications-dependent environment, availability impact alone justifies swift remediation.

Frequently asked questions

Can I be exploited if I'm not actively using a media app?

Potentially, if the RTP session handling runs in the background or as part of system services. However, active use of VoIP or video conferencing apps significantly increases the window of exposure. Patching remains the most reliable mitigation.

Does this affect my phone if I'm on a private home Wi-Fi network?

If an attacker has access to your Wi-Fi network, they can exploit this. For enterprise Wi-Fi, ensure your network access controls are properly configured. For personal networks, this is lower risk unless you have untrusted devices or visitors with malicious intent.

Why is this not on the KEV catalog yet?

The KEV catalog is maintained by CISA and includes vulnerabilities with evidence of active exploitation in the wild. This CVE may not have been widely exploited yet, or exploitation may not have been reported to CISA. Lack of KEV listing does not diminish the severity or your obligation to patch.

Will my phone automatically get the patch?

If you have enabled automatic system updates (Settings > System > System Update), yes. Otherwise, you must manually check for updates. Do not delay—prioritize this patch over other pending updates if available.

This analysis is provided for informational purposes and based on the vulnerability data available as of the publication date. Vendor patch availability, timelines, and affected versions may vary; consult official Google Android security bulletins for authoritative information. SEC.co makes no warranty regarding exploit availability or real-world attack prevalence. Organizations should conduct their own risk assessment based on their specific Android device inventory and deployment context. Source: NVD (public-domain), retrieved 2026-07-23. Analysis generated by SEC.co (claude-haiku-4-5).

Affected vendors

google

Weaknesses (CWE)

CWE-476

Related vulnerabilities