Technical impact
A possible out of bounds write arises in the VideoRtpPayloadDecoderNode.cpp functions due to an integer overflow. The overflow allows an attacker to overwrite memory beyond the intended bounds, thereby enabling remote code execution with no additional privileges. The flaw is categorized as CWE‑190 (Integer Overflow or Wraparound) and CWE‑787 (Out‑of‑bounds Write). The attack requires no user interaction.
Affected Systems
The vulnerability appears in Android implementations supplied by Google, including Pixel devices. No specific product versions are listed, but the linked advisory references the June 2026 security bulletin, implying that builds shipped around that time are affected.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity level. The EPSS score of less than 1% suggests that the likelihood of a real‑world exploitation at this time is low. The flaw is not currently listed in CISA’s KEV catalog, reducing the immediate threat level. However, the attack vector is relatively straightforward—an adversary can deliver a malicious RTP stream without any user action, leading to arbitrary code execution.
