CVE-2026-0160: Android RTP Text Decoder Remote Code Execution Vulnerability

Technical summary

CVE-2026-0160 is an out-of-bounds write vulnerability in the TextRtpPayloadDecoderNode::DecodeT140 function within TextRtpPayloadDecoderNode.cpp. The vulnerability arises from insufficient bounds checking when processing T.140 text data from RTP payloads. An authenticated remote attacker can craft a malicious RTP packet that, when decoded, causes the decoder to write beyond allocated buffer boundaries. This CWE-120 (Buffer Copy without Checking Size of Input) condition creates a memory corruption window that can be exploited to achieve arbitrary code execution with the privileges of the process handling RTP streams. The attack surface is network-facing and requires only L-level authentication (authenticated user context).

Business impact

Successful exploitation allows remote code execution within the Android runtime environment handling media streams. An attacker with valid credentials could escalate privileges, exfiltrate sensitive data, install backdoors, or disrupt media services. For organizations relying on Android devices for communications, this vulnerability represents a path to system compromise without requiring phishing or additional social engineering. The HIGH severity rating reflects the combination of high confidentiality, integrity, and availability impact. Devices in production environments may be silently compromised if RTP-based text communication is enabled.

Affected systems

Google Android is the affected vendor and product. The vulnerability resides in core RTP payload handling logic, making all Android versions and devices running vulnerable code susceptible. The exact version range requires verification against the Android Security & Privacy Year in Review or official security bulletin; users should cross-reference the published patch metadata for their specific device manufacturer and security patch level.

Exploitability

Exploitability is relatively high within the attack prerequisites. An attacker must first possess authenticated access (a valid credential or session on the network or device), but this is a reasonable barrier in many enterprise and consumer scenarios. Once authenticated, no additional user interaction is required—the malicious RTP packet triggers the vulnerability automatically during stream processing. Network accessibility is required, and the complexity is low. The CVSS vector (AV:N/AC:L/PR:L) confirms that remote, unauthenticated network-level access is not the attack path, but legitimate or compromised authenticated sessions are the realistic threat model. Publicly available exploit code is not known to exist at this time, but the straightforward nature of buffer overflows suggests weaponization risk is moderate.

Remediation

Apply the security patch provided by Google for Android. Organizations should prioritize deployment across all affected devices, especially those handling real-time communications or VoIP. Verify patch availability through the official Android Security & Privacy bulletin and your device manufacturer's update schedule. Interim mitigations may include disabling or restricting RTP text stream handling if operationally feasible, or segmenting affected devices from untrusted networks requiring authentication.

Patch guidance

Monitor the official Android Security & Privacy advisories for confirmed patch release dates and version numbers. Patches will likely be delivered through monthly security updates or emergency out-of-cycle releases depending on Android's release cycle. For device manufacturers (OEMs), verify availability in your firmware release pipeline. For enterprise deployments, coordinate with your mobile device management (MDM) platform to stage and deploy patches uniformly. Test patches in a non-production environment first to ensure RTP text stream functionality remains stable post-update.

Detection guidance

Monitor for unusual RTP packet patterns, particularly those with malformed or oversized T.140 text payloads. Intrusion detection systems with RTP inspection can flag packets with text encoding anomalies. On Android devices, enable and review crash logs and kernel panic dumps for patterns consistent with memory corruption (segmentation faults in libstagefright or media decoding libraries). Behavioral monitoring for unexpected process elevation or new privileged process spawning following media stream reception may indicate post-exploitation activity. Network-level detection of RTP streams from untrusted sources should trigger alerting in high-security environments.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.8), remote code execution capability, and minimal user interaction requirement. While authenticated access is a prerequisite, this barrier is often lower than assumed in network environments with shared credentials or compromised user accounts. The core impact—arbitrary code execution—allows complete device compromise. Organizations with media streaming or VoIP infrastructure should treat this as a critical patch priority.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) Network-accessible attack vector with no special network conditions required; (2) Low attack complexity, meaning a standard RTP packet crafting approach is sufficient; (3) Low privilege requirement—the attacker only needs a basic authenticated session; (4) No user interaction needed; (5) Unchanged scope (impact contained to the vulnerable system); and (6) High impact across confidentiality, integrity, and availability (all three rated High). The score appropriately captures that a motivated attacker with minimal authentication can achieve full system compromise.

Frequently asked questions