CVE-2026-0141: Android Pixel-family RtcpAppPacket OOB Read Vulnerability
Summary
CVE-2026-0141: In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2026-06-05. Fixed in Pixel-family specific:2026-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The RtcpAppPacket component is part of the Android operating system, specifically designed for handling Real-Time Transport Control Protocol (RTCP) application packets. This component is crucial for managing data transmission in real-time applications, ensuring that multimedia streams are delivered efficiently. However, it has been identified to have a vulnerability that could lead to serious security issues, particularly in Pixel-family devices.
Vulnerability Detail
In the decodeAppPacket function of RtcpAppPacket.cpp, there is a missing bounds check that can lead to an out-of-bounds (OOB) read. This vulnerability allows attackers to exploit the flaw remotely, potentially disclosing sensitive information without requiring any execution privileges or user interaction. The lack of proper validation in the code makes it susceptible to exploitation, which could have severe implications for user privacy and data security.
How To Fix
Minimum fixed version
Pixel-family specific:2026-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The CVE-2026-0141 vulnerability in the RtcpAppPacket component of Android Pixel-family devices poses a significant risk of information disclosure due to an out-of-bounds read. Users are strongly encouraged to update their devices to the latest patched version to protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2026-0141 is a vulnerability in the RtcpAppPacket component of Android Pixel-family devices that allows for an out-of-bounds read, potentially leading to information disclosure.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The primary risk is remote information disclosure, which means that an attacker could potentially access sensitive data without needing physical access to the device or user interaction.
Yes, a patch was released on June 5, 2026. Users are advised to update their devices to this version to mitigate the vulnerability.
If you cannot update your device, it is recommended to limit the use of applications that may utilize the RtcpAppPacket component until a fix can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
