CVE-2026-55343 Overview
CVE-2026-55343 is an out-of-bounds write vulnerability in the decodeAmr function of ImsMediaAudioPlayer.cpp, a component in the Android IMS media stack that decodes Adaptive Multi-Rate (AMR) audio frames. The flaw stems from a missing bounds check during AMR frame decoding. An attacker who convinces a user to interact with a crafted payload can trigger memory corruption and achieve remote code execution without elevated privileges. Google addressed the issue in the September 2026 Android Security Bulletin. The weakness is classified under [CWE-120] (buffer copy without checking size of input).
Critical Impact
Remote code execution on affected Android devices through a missing bounds check in AMR audio decoding, requiring only user interaction and no additional execution privileges.
Affected Products
- Android platform components including the IMS Media stack (ImsMediaAudioPlayer)
- Pixel devices as listed in the September 2026 Pixel Update Bulletin
- Android OEM builds shipping the affected ImsMediaAudioPlayer.cpp component
Discovery Timeline
- 2026-09-15 - CVE-2026-55343 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-55343
Vulnerability Analysis
The defect resides in the decodeAmr routine of ImsMediaAudioPlayer.cpp. This function decodes AMR-encoded audio frames received through the IP Multimedia Subsystem (IMS) media path used for VoLTE and VoWiFi calls. The routine writes decoded audio data into a fixed-size buffer without validating that the input length fits within the destination.
When an attacker supplies a malformed AMR frame, the write exceeds the buffer boundary. The overflow corrupts adjacent memory structures on the heap or stack region used by the media player. An attacker who controls the overwritten memory can hijack execution flow within the media process.
Root Cause
The root cause is a missing length check before a memory write inside decodeAmr. The decoder trusts frame metadata supplied by an untrusted source and copies payload bytes into a buffer sized for well-formed frames. Malformed frame headers that declare oversized payloads cause the copy to overrun the destination, matching the pattern described by [CWE-120].
Attack Vector
Exploitation requires network reachability to the target device and user interaction, consistent with an IMS call flow. An attacker sends a crafted AMR audio payload that the victim's device processes through the IMS media stack. Because the vulnerable code runs in a privileged media context, successful exploitation leads to remote code execution without additional privilege escalation steps.
No public proof-of-concept exploit is listed in the enriched data. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.212%.
See the Android Security Bulletin September 2026 for component-level technical references.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-55343
Indicators of Compromise
- Unexpected crashes or tombstone files referencing ImsMediaAudioPlayer or decodeAmr in /data/tombstones/
- Abnormal termination of the IMS media process during or shortly after an inbound call setup
- Malformed AMR frames observed in IMS/RTP traffic captures targeting a mobile endpoint
Detection Strategies
- Monitor Android crash telemetry for repeated SIGSEGV or SIGABRT signals in IMS media components
- Inspect RTP payloads carried over IMS bearers for AMR frames with inconsistent frame type or length fields
- Correlate call setup events with subsequent process restarts of the telephony or IMS media services
Monitoring Recommendations
- Ingest mobile device management (MDM) and Android event logs into a centralized data lake for anomaly review
- Track patch level compliance against the September 2026 Android Security Bulletin across the mobile fleet
- Alert on devices that fail to advance to the September 2026 or later security patch level within defined SLAs
How to Mitigate CVE-2026-55343
Immediate Actions Required
- Apply the September 2026 Android security patch level (2026-09-01 or later) to all managed devices
- Prioritize patching for devices used by high-risk users and those with active VoLTE or VoWiFi service
- Enforce minimum patch level requirements through MDM conditional access policies
Patch Information
Google released fixes as part of the September 2026 Android Security Bulletin. Refer to the Android Security Bulletin September 2026 for the authoritative list of fixed components and device coverage. OEM vendors distribute the corresponding patches through their own update channels, and administrators should confirm the security patch level reported by each device matches or exceeds 2026-09-01.
Workarounds
- Disable VoLTE or VoWiFi on unpatched devices where operationally feasible until the update is applied
- Restrict inbound calls to trusted contacts on high-risk devices pending patch deployment
- Educate users to avoid answering or interacting with unsolicited calls from unknown numbers
# Verify current Android security patch level on a managed device
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2026-09-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
