CVE-2026-0162: Memory Corruption Vulnerability in Android AudioSdpParser
Summary
CVE-2026-0162: In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2026-06-05. Fixed in Pixel-family specific:2026-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The affected package is part of the Android ecosystem, specifically related to audio processing functionalities. The AudioSdpParser is responsible for parsing Session Description Protocol (SDP) data, which is crucial for establishing multimedia sessions. This component is integral to various applications that handle audio and video streaming, making it a vital part of the Android operating system.
Vulnerability Detail
In the ParsePayloads function of AudioSdpParser.cpp, a type confusion issue can lead to memory corruption. This vulnerability allows for potential remote code execution without requiring additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous as it can be triggered by malicious SDP data.
How To Fix
Minimum fixed version
Pixel-family specific:2026-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability other than updating to the patched version. Users should avoid using applications that rely on the vulnerable AudioSdpParser until the update is applied.
Conclusion
CVE-2026-0162 represents a significant security risk within the Android ecosystem, specifically affecting the AudioSdpParser. Users are strongly advised to update their devices to the latest version to mitigate this vulnerability and protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2026-0162 is a critical vulnerability in the Android AudioSdpParser that can lead to memory corruption and potential remote code execution.
If your device is running a version prior to the patch released on June 5, 2026, it may be vulnerable. You can check your device's software version in the settings.
No, user interaction is not required. The vulnerability can be exploited remotely through malicious SDP data.
If you cannot update your device, it is recommended to avoid using applications that utilize the AudioSdpParser until a patch is available.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the gradle.lockfile. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
