CVE-2026-0151: Android Package Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-0151: In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. Affects :unknown: versions >= :0, < :2026-06-05. Fixed in :2026-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, which is a widely used operating system for mobile devices. Android applications often rely on various libraries and components to function effectively. This specific vulnerability resides in the IntfGraphCreate function of intfgraph.c, which is responsible for handling graphical interfaces. The vulnerability arises from an integer overflow, making it susceptible to exploitation.
Vulnerability Detail
In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This vulnerability can lead to remote code execution (RCE) without requiring additional execution privileges. The exploitation does not necessitate user interaction, making it particularly dangerous as attackers can potentially execute arbitrary code on affected devices remotely.
How To Fix
Minimum fixed version
:2026-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected functionality until the patch is applied. This could involve disabling certain features in your application that utilize the IntfGraphCreate function.
Conclusion
CVE-2026-0151 represents a significant risk to Android applications due to its potential for remote code execution. It is crucial for developers to update their applications to the patched version as soon as possible and to monitor for vulnerabilities using tools like Vulert.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2026-0151 is a vulnerability in the Android ecosystem that allows for remote code execution due to an integer overflow in the IntfGraphCreate function.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The primary risk is remote code execution, which can allow attackers to execute arbitrary code on affected devices without user interaction.
Yes, a patch is available as of June 5, 2026. It is recommended to update to the latest version of the affected package.
If immediate updates are not possible, consider implementing workarounds such as disabling the affected functionality until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
