CVE-2026-0130 Overview
CVE-2026-0130 is an out-of-bounds read vulnerability in the Android RtcpChunk::decodeRtcpChunk function. The flaw stems from a heap buffer overflow during RTCP (Real-time Transport Control Protocol) chunk decoding. An attacker can read beyond allocated heap memory, leading to remote information disclosure.
Google disclosed the vulnerability in the June 2026 Android Security Bulletin. Exploitation requires user interaction and low-level privileges but does not require elevated execution privileges on the target device. The vulnerability is tracked under [CWE-122: Heap-based Buffer Overflow].
Critical Impact
Remote information disclosure from Android device heap memory through malformed RTCP chunks processed during real-time communication sessions.
Affected Products
- Google Android (all versions covered by the June 2026 Pixel security bulletin)
- Devices implementing the affected RTCP decoding component
- Applications relying on the Android RTCP stack for real-time media
Discovery Timeline
- 2026-06-16 - CVE-2026-0130 published to NVD
- 2026-06-01 - Addressed in the Android Security Bulletin June 2026
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-0130
Vulnerability Analysis
The vulnerability resides in RtcpChunk::decodeRtcpChunk, a function responsible for parsing RTCP chunk structures during real-time media sessions. The decoder reads chunk fields without sufficient bounds validation against the underlying heap allocation. When a crafted chunk specifies sizes or offsets that exceed the buffer, the decoder reads adjacent heap memory.
The consequence is information disclosure rather than memory corruption. An attacker recovers heap contents that may include session metadata, pointers useful for bypassing Address Space Layout Randomization (ASLR), or fragments of sensitive user data. Exploitation requires the victim to engage with attacker-supplied content, such as joining a malicious media session.
Root Cause
The root cause is missing or incorrect length validation prior to a memory read within the RTCP chunk decoder. The function trusts attacker-controlled length or offset fields and dereferences memory beyond the allocated heap buffer. This pattern aligns with [CWE-122] heap-based buffer overflow weaknesses affecting protocol parsers.
Attack Vector
The attack vector is network-based. An attacker crafts a malformed RTCP chunk and delivers it to a target device through a real-time communication channel that triggers the vulnerable decoder. The victim must interact with the session — for example, by answering a call or opening a media stream — before the malicious chunk reaches decodeRtcpChunk. No additional execution privileges are required after the read occurs.
No public proof-of-concept code or exploit is currently available for CVE-2026-0130. Refer to the Android Security Bulletin June 2026 for technical specifics from Google.
Detection Methods for CVE-2026-0130
Indicators of Compromise
- Unexpected RTCP traffic from untrusted peers preceding media application crashes or anomalous behavior.
- Application logs showing abnormal termination of media services that invoke RTCP parsing.
- Outbound transmission of memory-like binary blobs from real-time communication apps after receiving inbound sessions.
Detection Strategies
- Monitor Android devices for repeated invocations of RTCP-handling components from a single remote endpoint.
- Inspect SIP/RTP/RTCP signaling at the network edge for malformed chunk lengths inconsistent with RFC 3550.
- Correlate media application crash telemetry with inbound session metadata to identify probing attempts.
Monitoring Recommendations
- Centralize mobile telemetry, signaling logs, and crash reports for cross-source correlation.
- Alert on Android security patch level below the June 2026 bulletin across the managed device fleet.
- Track outbound data volumes from communication apps after the start of inbound media sessions.
How to Mitigate CVE-2026-0130
Immediate Actions Required
- Apply the June 2026 Android security patch level (2026-06-01 or later) to all managed Android devices.
- Inventory devices running pre-patch Android builds and prioritize remediation through mobile device management (MDM).
- Restrict installation and use of real-time communication apps from untrusted sources until patching completes.
Patch Information
Google published the fix in the Android Security Bulletin June 2026. Devices must report a security patch level of 2026-06-01 or later to be considered remediated. OEM rollout schedules vary, so verify the patch level on each device class after vendor updates land.
Workarounds
- Block or filter inbound RTCP traffic from untrusted networks at enterprise gateways where feasible.
- Disable or uninstall non-essential real-time media applications on devices that cannot receive the patch immediately.
- Train users to decline media sessions and calls from unknown contacts until the patch is installed.
# Verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-06-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
