CVE-2026-0162: Android Audio SDP Parser Memory Corruption & RCE Vulnerability

Technical summary

CVE-2026-0162 is a type confusion vulnerability in the ParsePayloads function of AudioSdpParser.cpp (CWE-843) affecting Google Android. The flaw allows an authenticated, network-based attacker to trigger memory corruption by sending a malformed SDP payload. The type confusion permits writing to memory regions that should be protected, leading to code execution in the context of the audio processing service. No user interaction is required; exploitation occurs purely through network communication after authentication.

Business impact

Organizations deploying Android devices—particularly in BYOD environments, enterprise communications, and edge systems—face potential compromise of confidential data and device integrity. If an attacker gains authenticated access to a network or device, they can execute code to exfiltrate sensitive information, modify settings, install malware, or pivot to other systems. The authentication requirement moderately limits exposure but does not eliminate risk in environments where credentials are shared, compromised, or provisioned across multiple users.

Affected systems

Google Android is confirmed as the affected vendor. The vulnerability affects the audio SDP parser, which handles session description protocols used in VoIP, video conferencing, and real-time communication features. Any Android device receiving audio SDP payloads from a compromised or malicious authenticated peer is at risk. The scope is limited to the audio processing subsystem but may be triggered through popular communication apps that use SDP for session negotiation.

Exploitability

The attack requires prior authentication but no user interaction, making it relatively straightforward to exploit once an attacker has valid credentials. Network accessibility is direct (CVSS vector AV:N), and exploitation does not depend on unusual system configurations or race conditions. However, the authentication requirement (PR:L) provides a significant hurdle compared to unauthenticated attacks. An attacker in a compromised account, shared credential scenario, or insider threat context can immediately trigger the flaw. Public exploit code is not known to exist, but the simplicity of the vulnerability type suggests rapid weaponization is plausible post-disclosure.

Remediation

Administrators should patch affected Android devices to the fixed version provided by Google. Verify the specific Android security patch level that resolves CVE-2026-0162 via the official Android Security & Privacy Year in Review bulletin. For devices that cannot be immediately patched, restrict network access from untrusted sources and monitor for suspicious audio session negotiations. Review and revoke credentials for accounts with unnecessary network access to audio services.

Patch guidance

Consult Google's Android security advisory for CVE-2026-0162 to identify the required patch version. Apply security patches through standard Android update mechanisms (Settings > System > System Update). For enterprise deployments, validate patch availability for your specific device model and Android version before broad rollout. Verify that patched devices no longer accept the malformed SDP payloads by reviewing security patch release notes and testing in a non-production environment if feasible.

Detection guidance

Monitor network traffic for malformed or unexpected SDP payloads sent to audio services, particularly from authenticated but unusual peer addresses. Log access to audio subsystem functions and watch for crashes or restarts of audio services preceded by SDP negotiations. On-device, check system logs (logcat) for memory corruption errors, segmentation faults, or unexpected privilege escalation in the audioserver process. Behavioral indicators include unusual network connections from audio apps and unexpected code execution in the audio processing context.

Why prioritize this

This vulnerability merits urgent but prioritized remediation. The HIGH CVSS score (8.8) reflects confidentiality, integrity, and availability impact with low attack complexity. The critical factor is the authentication requirement—this is not a worm-capable flaw. Organizations should prioritize patching user-facing Android devices with high network exposure and devices handling sensitive communications. Lower-priority targets include isolated or air-gapped devices, devices with restrictive network policies, and systems where audio SDP is not actively used.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by the complete impact across confidentiality, integrity, and availability (C:H, I:H, A:H), low attack complexity, and network vector. The score is moderated by the requirement for valid credentials (PR:L), preventing automatic worm-like propagation. This reflects a serious flaw exploitable by authenticated insiders or attackers who have compromised credentials, but one that does not pose immediate enterprise-wide risk without credential compromise. The absence of user interaction means the attack is passive and reliable once triggered.

Frequently asked questions