CVE-2026-0161: Android RTP Integer Overflow Remote Privilege Escalation

Technical summary

CVE-2026-0161 is an integer overflow vulnerability in RtpSession.cpp's numberOfReportBlocks function that leads to out-of-bounds write via CWE-190 and CWE-787. When processing RTP report blocks, an integer calculation fails to prevent overflow, resulting in a smaller-than-expected heap or stack buffer allocation. Subsequent writes to this buffer exceed its boundaries, corrupting adjacent memory structures. An authenticated, network-adjacent attacker can trigger this condition without user interaction to achieve arbitrary code execution and privilege escalation within the affected process context.

Business impact

Compromise of Android devices—particularly those running vulnerable versions in enterprise or consumer deployments—opens avenues for lateral movement within network segments, data exfiltration, and persistence establishment. For organizations managing mobile device fleets or relying on Android in IoT or edge deployments, successful exploitation could undermine device integrity and compliance posture. The authenticated nature of the attack (CWE-190/787 exploitation) means vulnerable devices connected to malicious or compromised RTP endpoints face direct risk.

Affected systems

Google Android is confirmed affected. The vulnerability resides in core RTP session processing, suggesting impact across Android versions that include the vulnerable RtpSession.cpp code. Specific version ranges and device SKUs should be verified against Google's official advisory, as this researcher summary does not enumerate them. Organizations should cross-reference their Android security bulletin to determine their exposure.

Exploitability

The CVSS 3.1 score of 8.8 (HIGH) reflects the severity: an attacker with network access and valid credentials can exploit the vulnerability without requiring additional privileges or user interaction. However, the vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, suggesting no active in-the-wild exploitation at the time of disclosure. This does not eliminate risk; it reflects the vulnerability's relative newness (published June 2026) and may change as adversaries develop working exploits.

Remediation

Patch immediately using Google's official Android security update. The fix addresses the integer overflow in numberOfReportBlocks by implementing bounds checking and correcting the calculation logic. Devices unable to receive OTA updates should be isolated from untrusted network sources capable of initiating RTP sessions, though this is impractical for most deployments. Verify patching compliance in your fleet before returning devices to unrestricted network access.

Patch guidance

Apply the Android security patch released June 2026 or later, which corrects the integer overflow in RtpSession.cpp. Consult Google's official Android Security & Privacy bulletin for the exact build version and supported devices. OTA updates should deploy automatically on most devices; verify deployment status via device settings (Security > Google Play System Update). For enterprise-managed devices, validate patching through your MDM/EMM solution before permitting end-user access to network media streams.

Detection guidance

Monitor RTP traffic patterns originating from or directed at Android devices for anomalous report-block structures. Intrusion detection systems should flag oversized or malformed RTCP (RTP Control Protocol) packets. At the host level, watchdog memory corruption detectors and crash reporting may reveal exploitation attempts as segmentation faults in libstagefright or related RTP libraries. Log authentication events leading up to RTP session creation; authenticated access from unexpected sources warrants investigation.

Why prioritize this

A CVSS 8.8 HIGH-severity remote privilege escalation in core Android infrastructure affecting millions of devices globally warrants immediate triage and patching. The authenticated-but-no-UI-interaction attack vector and impact on confidentiality, integrity, and availability (C:H/I:H/A:H) place this in your top tier. Although not yet in the KEV catalog, the logical exploitability and risk profile make delay costly. Prioritize devices in sensitive environments (healthcare, finance, government) and those lacking regular patch cadence.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields 8.8 because: network accessibility (AV:N) allows remote triggering; low attack complexity (AC:L) means no special conditions; low privileges required (PR:L) places it within reach of authenticated users; no user interaction (UI:N) eliminates social engineering; scope unchanged (S:U) confines damage to the vulnerable process; and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) reflects full system compromise potential. The absence from KEV does not reduce the score, which is intrinsic to the flaw's severity.

Frequently asked questions