Description
In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Published: 2026-06-16
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A missing null check in the RTP session handling code may allow an attacker to trigger a memory safety flaw, leading to a denial‑of‑service condition. The vulnerability does not grant additional privileges and can exhaust resources or crash the application, rendering the device unavailable to legitimate traffic.

Affected Systems

Google Android devices; no specific product versions are listed in the advisory, so any unpatched Android install could be affected.

Risk and Exploitability

The EPSS score is less than 1 % and the flaw is not listed in the CISA KEV catalog, indicating a low current exploitation probability. Exploitation can be performed remotely over the network by sending specially crafted RTP packets, and it requires no user interaction. The weakness involves a null pointer dereference (CWE‑476).

Generated by OpenCVE AI on June 17, 2026 at 21:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update your device to the latest Android security patch that includes the RTP session null‑check fix.
  • If an update cannot be applied immediately, restrict or block RTP and related real‑time communication traffic on the device or network firewall to prevent malicious packets from reaching the application.
  • Monitor device logs for repeated RTP errors or connection crashes, and apply network‑level intrusion detection if available.

Generated by OpenCVE AI on June 17, 2026 at 21:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 16 Jun 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Vendors & Products Google
Google android

Tue, 16 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Description In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
References

Subscriptions

Google Android
cve-icon MITRE

Status: PUBLISHED

Assigner: Google_Devices

Published:

Updated: 2026-06-16T18:51:28.954Z

Reserved: 2025-10-23T08:44:51.869Z

Link: CVE-2026-0156

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-06-16T20:16:26.240

Modified: 2026-06-16T20:42:25.013

Link: CVE-2026-0156

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-16T20:45:02Z

Weaknesses

No weakness.