CVE-2026-0127: Medium severity Google Android vulnerability
In NrmmMsgCodec::DecodeUPUTransparentContext of cnNrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote denial of service causing a communication processor crash with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network exposure of the affected communication processor: place it behind a firewall or VPN, apply ACLs to allow only trusted management/peer IPs, and segment it from untrusted networks to reduce the attack surface for remote exploitation.
- Operational
Implement monitoring and automated recovery for the communication processor: collect crash logs and memory dumps when the process fails, alert on crashes or service interruptions, and configure automated restart procedures so availability is restored quickly while investigation and a vendor fix are pursued.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0127?
CVE-2026-0127 has a medium severity rating of 6.5 based on the CVSS v3.1 scoring.
How do I fix CVE-2026-0127?
To fix CVE-2026-0127, update the affected Google Android software to the latest security patch provided by the vendor.
What type of vulnerability is CVE-2026-0127?
CVE-2026-0127 is an out-of-bounds read vulnerability due to memory corruption.
What is the risk associated with CVE-2026-0127?
The risk associated with CVE-2026-0127 includes potential remote denial of service, causing a communication processor crash.
Is user interaction required for exploiting CVE-2026-0127?
No, user interaction is not required to exploit CVE-2026-0127.