CVE-2026-28618: OAPV Decoder RCE Vulnerability

CVE-2026-28618 Overview

CVE-2026-28618 is a heap buffer overflow vulnerability in the dec_frm_prepare function of oapv.c, a component of the Open Advanced Professional Video (OAPV) codec used within Android. The flaw allows an out-of-bounds write on the heap during frame preparation in the decoder. Successful exploitation leads to remote code execution without additional execution privileges and without user interaction. The issue is tracked under CWE-122: Heap-based Buffer Overflow and was published in the Android Security Bulletin September 2026.

Critical Impact

Attackers can achieve remote code execution on affected Android devices by delivering a crafted OAPV media stream that triggers the heap overflow during decoder frame preparation.

Affected Products

• Android platform components incorporating the OAPV codec (oapv.c)
• Devices covered by the Android Security Bulletin dated 2026-09-01
• Downstream vendor Android builds bundling the vulnerable OAPV decoder

Discovery Timeline

• 2026-09-08 - CVE-2026-28618 published to NVD
• 2026-09-01 - Fix addressed in the Android Security Bulletin September 2026
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-28618

Vulnerability Analysis

The vulnerability resides in dec_frm_prepare inside oapv.c, part of the OAPV video decoder pipeline. During frame preparation, the decoder allocates heap buffers sized from attacker-influenced fields in the input bitstream. A missing or insufficient bounds check on these fields lets the decoder write past the end of the allocated buffer.

Because the write occurs on the heap, adjacent allocations and metadata become corruptible. An attacker who controls the overflowed bytes can overwrite function pointers, object vtables, or allocator metadata reachable by the media server process. This creates a path from memory corruption to arbitrary code execution in the context of the media parsing process.

The network attack vector combined with lack of user interaction means a malicious video delivered through messaging, browsing, or streaming can trigger the flaw automatically once parsed.

Root Cause

The root cause is inadequate validation of size or index parameters extracted from the OAPV bitstream before they are used to compute write offsets in dec_frm_prepare. The function trusts values from the untrusted stream, producing an out-of-bounds write on the heap [CWE-122]. See the Android Security Bulletin September 2026 for the referenced fix.

Attack Vector

An attacker crafts a malformed OAPV stream and delivers it to a target through any channel that invokes the platform media decoder. When the decoder calls dec_frm_prepare on the crafted frame, the heap overflow occurs and the attacker gains code execution in the media processing context. Exploitation requires no user interaction beyond receiving or opening media that is auto-parsed by the operating system.

No public proof-of-concept exploit is currently listed for this CVE. Refer to the vendor advisory for technical details of the fix.

Detection Methods for CVE-2026-28618

Indicators of Compromise

• Unexpected crashes or SIGSEGV signals in media server or codec processes referencing oapv symbols.
• Tombstone or logcat entries showing heap corruption or abort messages originating from dec_frm_prepare.
• Delivery of OAPV-formatted media from untrusted senders or unfamiliar domains immediately prior to a crash.

Detection Strategies

• Monitor Android crash telemetry for repeated media decoder faults tied to OAPV parsing.
• Inspect network and messaging telemetry for unusual OAPV payloads delivered to endpoints running unpatched builds.
• Correlate device patch level against the September 2026 Android Security Bulletin to identify exposed fleets.

Monitoring Recommendations

• Centralize mobile device crash and integrity telemetry for review against known media codec vulnerabilities.
• Alert on outbound connections initiated by media handler processes shortly after decoding untrusted content.
• Track Android security patch level (ro.build.version.security_patch) across managed devices to confirm coverage.

How to Mitigate CVE-2026-28618

Immediate Actions Required

• Apply the Android security patch level dated 2026-09-01 or later on all managed devices.
• Prioritize patching for devices that regularly receive media from external or untrusted sources.
• Restrict auto-download and auto-preview of media in messaging clients until devices are updated.

Patch Information

The fix is delivered through the September 2026 Android Security Bulletin. Device manufacturers ship the corrected OAPV component through their monthly security update. Confirm remediation by validating that the device security patch level is 2026-09-01 or later. Full details are available in the Android Security Bulletin September 2026.

Workarounds

• Disable automatic media preview and download in messaging and email applications where feasible.
• Block untrusted media sources at the network perimeter until endpoints receive the vendor patch.
• Use mobile device management (MDM) policy to enforce minimum OS patch levels before granting corporate resource access.

# Verify Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later