CVE-2026-0165: Android RTCP Decoder Out-of-Bounds Read Information Disclosure

Technical summary

The vulnerability exists in multiple functions within Android's RTCP packet decoder where insufficient bounds validation permits an out-of-bounds read condition. RTCP packets received over the network are processed without adequate length or offset verification, allowing an attacker to craft malicious packets that reference memory locations beyond the intended buffer. This maps to CWE-120 (Buffer Copy without Checking Size of Input) and CWE-125 (Out-of-bounds Read), indicating classic memory safety issues common in C/C++ network protocol handlers. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) reflects network-based attack delivery, low attack complexity, requirement for low-level privileges, user interaction dependency, and high confidentiality impact without integrity or availability compromise.

Business impact

Information disclosure vulnerabilities in media processing codecs pose a significant risk to enterprises relying on secure communications. An attacker positioned on the network or controlling a malicious media endpoint could extract sensitive information from affected devices, including session keys, personal data, or authentication credentials. For organizations handling regulated data (healthcare, finance, legal), such leakage may trigger compliance violations. The low attack complexity and lack of special privileges required amplify the business risk, particularly in environments where employees join calls from untrusted networks. However, the user interaction requirement (accepting a call or stream) provides a narrow but real window of control.

Affected systems

Google Android devices are affected by this vulnerability. The exact version boundaries are not provided in the advisory; verify specific impacted Android versions against the official Google Security Bulletin. RTCP processing is fundamental to real-time communication—VoIP calls, video conferencing, and media streaming applications—so any Android device capable of making or receiving calls or participating in media sessions is potentially affected. Devices running older Android versions or those not receiving timely security updates face elevated risk.

Exploitability

Exploitation is feasible but not trivial. An attacker must first establish a network path to deliver malicious RTCP packets to the target device, typically by controlling a media endpoint in a call or conference, or by man-in-the-middle positioning. Second, the attacker must craft RTCP packets with carefully chosen offsets to read interesting memory regions. Third, user interaction is required—the target must accept or engage with the malicious media stream. The combination of these factors keeps this from being trivially exploitable in mass campaigns, yet skilled attackers with access to a compromised call participant or rogue media server can reliably trigger disclosure. The vulnerability is not listed in the Known Exploited Vulnerabilities catalog, suggesting active weaponization is not yet widespread.

Remediation

Apply the official security patch from Google when it becomes available. Until then, mitigate risk by restricting media communication to trusted endpoints, disabling real-time communication features when not required, and monitoring network traffic for suspicious RTCP patterns. Users and administrators should prioritize timely security updates as part of their patch management program.

Patch guidance

Monitor Google's official Android Security & Privacy Year in Review and monthly security bulletins for patch availability. When patches are released, deploy them to all affected Android devices according to your organization's update policy. For enterprise-managed devices, coordinate deployment through your Mobile Device Management (MDM) solution to ensure systematic coverage. Verify patch application by confirming the Android security patch level on each device after update completion.

Detection guidance

Detection is challenging since RTCP is a legitimate protocol component of all media calls. Monitor for: (1) unusual call or media session initiation patterns, especially from unexpected or external endpoints; (2) network traffic analysis showing malformed or oversized RTCP packets; (3) endpoint behavior anomalies such as unexpected memory spikes or process crashes during media handling; (4) logs from communication applications reporting protocol errors or packet parsing failures. Behavioral indicators of successful exploitation (data exfiltration following a call) are more reliable than network-level detection of the attack itself.

Why prioritize this

Assign this vulnerability medium priority in your patch queue. While the CVSS score is moderate (5.7) and active exploitation is not yet observed, the attack surface is wide (all Android devices using media), the impact is confidentiality-focused but still serious, and the barrier to exploitation is moderate rather than high. Prioritize patching devices used by high-risk users (executives, finance teams, legal staff handling sensitive calls) and those on untrusted networks before rolling out to lower-risk populations. The user interaction requirement provides some breathing room compared to zero-click vulnerabilities, but should not delay remediation indefinitely.

Risk score, explained

The CVSS 3.1 score of 5.7 (MEDIUM) reflects: network-based attack vector (AV:N) that does not require special network positioning; low attack complexity (AC:L) indicating no special conditions beyond crafting a malicious RTCP packet; low privilege requirement (PR:L) meaning a regular, authenticated participant in a call can initiate the attack; required user interaction (UI:R) where the target must accept or engage with the compromised media stream; unchanged scope (S:U) with impact confined to the attacked device; and high confidentiality impact (C:H) with no integrity or availability loss (I:N/A:N). This profile correctly captures a 'medium' threat—serious enough to patch promptly, but not an emergency requiring emergency procedures.

Frequently asked questions