CVE-2026-0148

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jun 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-01498.8In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution withCVE-2026-01507.8In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow. This could lead to CVE-2026-01518.8In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code executCVE-2026-01527.8In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of boundCVE-2026-01537.8In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalaCVE-2026-01548.8In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote coCVE-2026-01555.3In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information discCVE-2026-01567.5In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remoteCVE-2026-01574.3In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosurCVE-2026-01584.0In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disCVE-2026-01598.8In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no aCVE-2026-01608.8In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds c
CVE-2026-0148: High severity, CVSS 8.8 | Vulnix