CVE-2026-0128: Integer Overflow
In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Limit network exposure of components that process RTCP feedback packets: restrict access to the service/port using network controls (firewall, ACLs, WAF) so only trusted hosts can send RTCP traffic until a vendor fix is applied.
- Operational
Advise users and administrators to avoid interacting with untrusted media sessions or content that could trigger processing of RTCP feedback packets (user interaction is required for exploitation) until a patch is available.
- Operational
Monitor vendor and security advisories for a fix addressing RtcpFbPacket::decodeRtcpFbPacket and apply the supplied update/patch as soon as it is released; verify release notes reference the RtcpFbPacket::decodeRtcpFbPacket fix.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0128?
CVE-2026-0128 has a medium severity rating of 6.5 according to CVSS 3.1.
What kind of vulnerability is CVE-2026-0128?
CVE-2026-0128 is an integer overflow vulnerability that results in a possible out of bounds read.
What could happen if CVE-2026-0128 is exploited?
Exploitation of CVE-2026-0128 could lead to remote information disclosure without requiring additional execution privileges.
Is user interaction required to exploit CVE-2026-0128?
Yes, user interaction is needed for the exploitation of CVE-2026-0128.
How do I mitigate CVE-2026-0128?
To mitigate CVE-2026-0128, ensure that your Google Android devices are updated with the latest security patches.