Description
In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-06-16
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A missing null check in the RTP session handling code may allow an attacker to trigger a memory safety flaw, leading to a denial‑of‑service condition. The vulnerability does not grant additional privileges and can exhaust resources or crash the application, rendering the device unavailable to legitimate traffic.

Affected Systems

Google Android devices; no specific product versions are listed in the advisory, so any unpatched Android install could be affected.

Risk and Exploitability

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is less than 1 % and the flaw is not listed in the CISA KEV catalog, indicating a low current exploitation probability. Exploitation can be performed remotely over the network by sending specially crafted RTP packets, and it requires no user interaction. The weakness involves a null pointer dereference (C‑476).

Generated by OpenCVE AI on July 8, 2026 at 08:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update your device to the latest Android security patch that includes the RTP session null‑check fix.
  • If an update cannot be applied immediately, restrict or block RTP and related real‑time communication traffic on the device or network firewall to prevent malicious packets from reaching the application.
  • Monitor device logs for repeated RTP errors or connection crashes, and apply network‑level intrusion detection if available.

Generated by OpenCVE AI on July 8, 2026 at 08:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title Memory Safety Issue in Android RTP Session Can Cause Remote Denial of Service

Mon, 06 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title Memory Safety Issue in Android RTP Session Can Cause Remote Denial of Service
Weaknesses CWE-476

Tue, 16 Jun 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Tue, 16 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Description In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: Google_Devices

Published:

Updated: 2026-07-06T14:39:15.708Z

Reserved: 2025-10-23T08:44:51.869Z

Link: CVE-2026-0156

cve-icon Vulnrichment

Updated: 2026-06-16T19:50:08.314Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-06-16T20:16:26.240

Modified: 2026-06-16T20:42:25.013

Link: CVE-2026-0156

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-08T09:00:14Z

Weaknesses