CVE-2026-0157: Android RTCP Header Buffer Overflow – Remote Information Disclosure

Technical summary

The vulnerability is an out-of-bounds (OOB) read in the RtcpHeader::decodeRtcpHeader implementation within Android's media stack. The root cause is a missing bounds check during RTCP header parsing, classified under CWE-120 (Buffer Copy without Checking Size of Input) and CWE-125 (Out-of-bounds Read). An attacker with authenticated network access can craft a malicious RTCP packet that causes the decoder to read beyond allocated buffer memory, disclosing adjacent heap or stack data. The CVSS 3.1 score of 4.3 (Medium severity) reflects network-based attack surface with low complexity and authentication requirement, but no impact on confidentiality, integrity, or availability of the system itself—only information disclosure to the attacker.

Business impact

This vulnerability primarily threatens confidentiality in real-time communication scenarios. Organizations and users relying on Android devices for VOIP, video conferencing, or peer-to-peer media streams face potential leakage of session metadata, cryptographic material, or other memory-resident secrets. The low barrier to exploitation—no user interaction required—means any authenticated application or network peer can trigger the flaw during normal media sessions. Enterprises managing Android-based communication infrastructure or MDM deployments should assess exposure in their deployed base, particularly devices handling sensitive calls or classified communications.

Affected systems

CVE-2026-0157 affects Google Android across versions running vulnerable media framework code. The exact affected version range should be verified against Google's Android Security & Privacy Year in Review and monthly security bulletin. Devices must have: (1) vulnerable Android OS build, (2) an active network connection, and (3) an authenticated peer or application capable of initiating RTCP communication. The vulnerability does not require root, special permissions, or user interaction on the target device, making all current-generation Android devices with the vulnerable code a potential target.

Exploitability

Exploitability is straightforward from a technical standpoint. The attack requires network access and authentication (likely the initiating party in a media session), but neither condition is onerous in practice: most Android devices connect to untrusted networks, and RTCP is initiated by design during media calls. An attacker controlling a VOIP service, rogue access point, or compromised media relay can send a single crafted RTCP packet to trigger the OOB read. No user interaction, no permission grants, and no local code execution are necessary. The attack is passive from the target device's perspective—no crash, log, or user-visible side effect—making it suitable for covert information harvesting. However, the vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting in-the-wild exploitation has not been publicly confirmed as of the publication date.

Remediation

Resolution requires a patched Android system image that implements bounds checking in RtcpHeader::decodeRtcpHeader. Google typically releases such fixes via monthly Android Security & Privacy updates or as backports to extended support branches. Users should enable automatic system updates and install the next available Android security patch. Device manufacturers may release updates on different schedules; check vendor OTA channels for patch availability. Organizations managing Android devices should enforce a policy requiring installation of security updates within 30 days of availability and audit for devices still on unpatched builds.

Patch guidance

Obtain the patched Android security update through your device manufacturer's OTA (over-the-air) update mechanism or security bulletin. Verify the patch version against Google's official Android Security & Privacy bulletins to confirm the fix for CVE-2026-0157 is included. For enterprise devices, deploy via MDM to enforce compliance. Backports may be available for supported Legacy Android versions; check your vendor's security advisory for explicit version numbers and eligibility. Testing the patch in a non-production environment before wide rollout is recommended to ensure no regression in media functionality.

Detection guidance

Network-level detection is challenging because the vulnerability is triggered by a single RTCP packet with malformed headers, which may closely resemble legitimate packets. Endpoint detection should focus on: (1) monitoring RTCP traffic patterns for unusual packet structures using packet inspection tools, (2) instrumenting media stack logs for unexpected buffer read errors or memory access violations during RTCP decoding, and (3) correlating suspicious RTCP flows with subsequent sensitive data exfiltration or authentication anomalies. Host-based intrusion detection signatures targeting out-of-bounds memory reads in media processes may offer some signal. Because the vulnerability is silent (no crash or error), assume an information-disclosure attack is most likely undetectable in real time; prioritize patching over detection.

Why prioritize this

Despite a Medium CVSS score, this vulnerability merits near-term patching for organizations with VOIP, video conferencing, or media-rich communication workloads. The combination of zero user interaction, network-exploitability, and silent exploitation creates a stealthy lateral reconnaissance vector for attackers already on a network. The lack of KEV or public exploit code suggests a narrow window before weaponization; proactive patching avoids reactive damage control. Conversely, organizations with minimal real-time communication traffic can defer patching to a regular maintenance cycle without elevated risk.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) Network-based attack vector (AV:N), (2) low attack complexity (AC:L), (3) requirement for authenticated access (PR:L), (4) no user interaction (UI:N), and (5) limited impact to confidentiality (C:L) with no integrity or availability impact (I:N/A:N). This baseline is appropriate for a silent information disclosure flaw requiring valid credentials. However, the true risk escalates if the disclosed data includes cryptographic keys or session tokens, or if the attacker can chain the leak to lateral movement. Organizations should adjust their internal risk rating based on (a) the sensitivity of data in adjacent memory buffers, (b) the authentication model of their RTCP peers, and (c) the prevalence of unpatched Android in their environment.

Frequently asked questions