CVE-2026-0131

HighCVSS 7.3/10Last modified Oct 25, 2026

Description

In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125CWE-190

Affected software

VendorProductVersions
GoogleAndroidAndroid kernel

References

Timeline

Published
Jun 16, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-01328.8In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additionalCVE-2026-01337.8In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permissiCVE-2026-01344.0In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This CVE-2026-01357.8In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with no additional CVE-2026-01367.5In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additionCVE-2026-01377.8In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lCVE-2026-01387.8In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption. This could lead to local escaCVE-2026-01398.8In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additionalCVE-2026-01404.3In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosCVE-2026-01415.3In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information dCVE-2026-01424.0In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local inforCVE-2026-01437.8In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local